24fffadca7e38bb96b1bae91bfb17bc47427229e3f25cbf9346834248f9bdaee

Analysis

max time kernel
141s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 15:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cfd5ecd6400b86c8870ddd025838360c_JaffaCakes118.html
Size

139KB
MD5

cfd5ecd6400b86c8870ddd025838360c
SHA1

94c36c98abc3400d86ac427ca63549d00d57f90a
SHA256

24fffadca7e38bb96b1bae91bfb17bc47427229e3f25cbf9346834248f9bdaee
SHA512

8f25f8843f30ba5fb43c5cce9f21912d239cca9ac7810d8f3feb481928a6cc635c82fec2ba08776ad714f33c9854738c50ea0a9cb5e3273841f7153689fbc0d8
SSDEEP

1536:S9pa16nloryLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTs:S9doyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf600000000020000000000106600000001000020000000319cf29bc43c2db1aa1b7998ba8fb51aa249f06889585e1c79ddba28d8067346000000000e8000000002000020000000c4931d8b6bf5003153e0e30bdeeb14124cbe986c4bea624a2091d80e5d60088920000000630185367dfd07e44333aca224e3205938d8fc00b1e82af73c7996f1c0683ea640000000370fe07bc2f054340ae94aaee11f85d04b058f63384b86cfc36b5ce9a9805e4ffe3fa28666022e8a8cbbdc595056f82dce0ce473e60ad391b95332f68c274df0	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60f0a39f7000db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf600000000020000000000106600000001000020000000b8029ae6695b51f8696771c47d3630b4c33694633e5993a88ac9b915029817d3000000000e80000000020000200000007e7a999fada539405bf5f01cd6a8f9214a1a6857eeb83995c52d5c2808b0ff2690000000a9036057c32c2eb40f3304371c4e62d8134337407ea45c609c6635767bc203230733b35fc5e32198b044b5093b480958f065d2771c97cf93672423beba01e3c7013db066993baf42589de8d9f768f6718fac5208a4cd2acac46bd08deffce163bf82109a9a934da818341ae98856b24acc0eb1972c14f377f2106af7dc30b3c4c6f9e83baa6bd1d9801e0fbdd349cffa400000001d25bc8ff3cffb3554f4c187451ca2cb190f27ecfd1741ddb9136c801ec31e99e092fd0a39a4f97067e36071410b2159729f681252c92681bb1832758473fa98	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{894AC6E1-6C63-11EF-A0FF-7ED3796B1EC0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431797891"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2216	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2216	iexplore.exe
2216	iexplore.exe
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2800	2216	iexplore.exe	30
PID 2216 wrote to memory of 2800	2216	iexplore.exe	30
PID 2216 wrote to memory of 2800	2216	iexplore.exe	30
PID 2216 wrote to memory of 2800	2216	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cfd5ecd6400b86c8870ddd025838360c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2216 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cfca3748c3d0420b0aa48ca284230d53

SHA1
d1e0e6cdd3ed20cb7e0c00e322cbed8b875caed9

SHA256
316a9100bcf421a2a0025db703dd38e6cf903f94b7d21835e0e13be6cb93023d

SHA512
68369ee24bb44d39334342f5924130cfc6c761e64f6e17e2ad8cfa5c306881b742fe58589963cc0d0ca19fe89fa42a5c0fa05f728624de15fe54da71a3d6f608

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3e6d28450d37346a02bbb74e1630e7b

SHA1
9b6e2678bfdece963e74c16472d99ec93fdf40a9

SHA256
75f4d70aaf7d45a4f6b3dd20b7a6cce59737c9e443baa2163e9c81a9b28009d8

SHA512
5c04f7508cdef7a04cb5b6559688914b56b646d0dd493e53c1853b2ef6b0eb32daf085ade30b6d69e29f644e032783f4173c542308ef4235c4ebaeef6c9c8351

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff7665cd237c3afcc8d8ee109cbb0a88

SHA1
c9771dbf6577157de7ffe25b0f688cb0fdab7a35

SHA256
75e381dfa661de846bf3559b3edcbb3318bece975ae73cfd6c1d7bb78482e52b

SHA512
38d5a8465d7132141c0f4e8728123ab0c5a1aa97c9577b6129063f0110bfbe7b347a26f58eca138c08fb1e5a3cfa8db500ca8247dbe8658353ddbaec56076659

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b109cebcf3e98abd1f7b375fa9b720b

SHA1
691a22621ae05a1724303a4bd7de64b0757848e1

SHA256
e39d67df89312c0c1b6f0fda7b68662830c1617f5cc7d98609f835f0d0915a42

SHA512
b352f179e579cf2399127acfa86304cb2b7fc2fd94f8591b1b573e17c8b60773f0d6fc5d55539991185e4c1640dae3539965cb2e470a671cbde7d9227d8327d7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f2267e27c507c77888075d09ebc4581

SHA1
5502797df3804f684f8a7ecf894025747923a6b1

SHA256
8303feec3e0b0c7423de88e310e19034eff6fa91a0c209f4f88416ae99126d05

SHA512
5f197cc98e41731bdf704d055c43f9218b804782c4853e0f7c2a6026d567f4f3c2a5112bf254b2b31354e8f5daa02ae89c8e0642583dcc2a6d8323b3fe59bdbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe6316c33b708fb40b94e0a0ce558d6a

SHA1
6408099ddf1016da54053d9823b3aa3d2c89a85f

SHA256
10e0e76e40048a6f14e5f9b810aca3a5502901a23dd2eeac0bcaa0aed6e1195c

SHA512
c2ac481768dbb38bd5bbb98953fe4c631341f099777c41bb7762c0530b42d59ebe67ead132d6451e0e4c8ae9be79e94839d4928888a44a0d06155253839765cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf729d7710d767320893cc8070fd06d0

SHA1
4c5945a4d0a0f4d0510ad0976b9c515c71b46cab

SHA256
9e1724b975c6e179ce87c53da5dace619591fd5e77cc747e2c418d63267239b1

SHA512
5c326c13c9607124754157c4db3c57b8f8a7261cd02241eeceab39637620f6ca4e4e97db05aafb2ead5cb0a72e67dded9075f72275eee7cf2b528434052f03e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3791b9175d3a6f5b93d9ebc03969c8ad

SHA1
9ace39959233b9746f737f6bca45dd9dfc0bc3f6

SHA256
4063e5ee084a32f0410bbda3b95882c17ded46e7820e84772e57fb0a9f7447be

SHA512
5febe1a108292b0adc3780171bfe9d3b8dd97981f2c403361caaceef274234f7c458983ace95d2fac4dfeb55370a5cad84d00cea7f9015ac75d91211c9d1e716

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81bbc3258d996631c7c8fca2bed52a6b

SHA1
c8baeba10889e4f8fa3c7e7fac5a9084abde2a72

SHA256
8be2dd83d34c76be13afef07e1afd0eb110f9d9ec7c5c27aaf12088e06a777ce

SHA512
9234743a8abd323d5b819cc30e4b056913460c1b484e7d87b4fa5b3beebd749389ff05c1d24215dcead14bc3bb91a7da4285fa9b92c8fdcd121a5c77198ac995

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa6143ccbb06bf3dbb8b34078bd41695

SHA1
ad2e50aea9372d5cec13ba1cc4f34d2c983aa3c1

SHA256
87fa727b7167d83e8ad23b695847098e075d82fc2dfff564f45e74cb3686ef0b

SHA512
0e93b5bc138434e077190698589c3969215be784add82da31e50af440a1f3757de62b3bcbabf7f78b2242d61ddf5ac6e9aae7bcd902f07808f93f00050ae1587

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90ffd175977408cbb6fcfe338329b5d4

SHA1
975a131630022c8403097b67b88c47507ed2691b

SHA256
362fcb475634cda17ea709678c0f453115a95a537d9e0230ae36b609d4281f16

SHA512
ea1f394b284998345c034d67a226ce9f1bebb340d9a9300e3c318796630f77cd784ed1dfcb30cd816368204c210d856f01eaf7d18721822f270e0f5e127114cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab819E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8220.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit