6272e9f88fdc4d499042b27a531b7f0a935d7e5f5b6a4f4f490104a1717f0028

Analysis

max time kernel
139s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 16:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cfeabca8061a1a96ddc305d046a9acfd_JaffaCakes118.html
Size

26KB
MD5

cfeabca8061a1a96ddc305d046a9acfd
SHA1

9efb75713efc008f5ecafe56a14cf666be466d41
SHA256

6272e9f88fdc4d499042b27a531b7f0a935d7e5f5b6a4f4f490104a1717f0028
SHA512

f322cfd82891efe5d24f9490919dec23f36d304553e162283c0bf3b09df7a70015fd59994114c658f7b39202f794e6f4bd91b1c9da927c765fa3f16127f7bad0
SSDEEP

384:J9IrLVjennHi/WaLLLLbLLeLLLLLLLnLLLLwLLRLLLLLLL6LLLLkCw1KLLkLLLLM:ULVjenWWPw1wVyOLqtXo

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0ec3d2f7600db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{560E0CF1-6C69-11EF-9F30-7694D31B45CA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000119d002a38395cd437c7fd7f588493c82fc79b33cea3092987bd1958a1bbe895000000000e80000000020000200000003fa4326d8efd73f49e5f761e1be1e5d10a7c9b7eaa920b40efaa992e31e07f8e90000000608693bb1847dec11109bcea5fbfd1b7b8e069444734b7661e3866bb9169d40d14616c8b94ee5ca0d6aafc628597825fd6e0085301aa509ae5b644c9f9549288873f0e4000ef3802937c1330a3ddd1c5861ac338130973c65e3d6757bd7cb6e1f0a7cfb250d620de7572143114f982122284ca2a0a6bf14a07d9ea4608f728514017db0cc55295bd6de9fa868abf479d40000000bc7eb1576883e02a9846604a324dfc7b994b1985b1b2b31d8d6b1a13d0e497ad3deb43266848d7794dd56e635c43242bee5f7f62cbecb9750c855cf425d3da9a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000488c645720133deba521e8e9ee70c8f49ca13d4f5bfa6a54a9457854b4c6d227000000000e800000000200002000000094d4c2abce894fc6263687c6376f1e57ef9c825ac3a6f8c2daabdaf6fa27f1b620000000e0061a381b8cc1e3af70f87a3a98e1d3efdedfc82bc752aa4294a82d4036a5ba40000000df64bf3a5cea3c702d2665a1fbef1d5cc848c498646b71988513f5591d905d4e06f450faae42dcfade5391edd6fff493b99d6947cd2008f6a14d13301b453dcc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431800393"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2068	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2068	iexplore.exe
2068	iexplore.exe
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2412	2068	iexplore.exe	30
PID 2068 wrote to memory of 2412	2068	iexplore.exe	30
PID 2068 wrote to memory of 2412	2068	iexplore.exe	30
PID 2068 wrote to memory of 2412	2068	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cfeabca8061a1a96ddc305d046a9acfd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2068 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0744b0bb94c407bf019f65134b27d9ac

SHA1
f4261c7d6b64f8b282604fbdc7fbb65a5b6dddf0

SHA256
a7b4b85d46722148b65ac8fb7ad3af6d1fe530b0ac3cd001a2d881bab1c9b645

SHA512
4e4dd92d1b73a62459912ce7315ac7227768820373c9dd907bdb3d423f3a727046c860efa089408932f2deba60f0a31d91af8e8d0c5cc0e940657940aed9b3ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df7e0d56350be8947e4124c78b7d60de

SHA1
b3b2a4f0af523abe62e37a270fdbc9af12996871

SHA256
16b03493cbaa502238d6b14d7ec7107e414538ad7c8a9872d1894a0b09654909

SHA512
edb4eee77fcd49bf21a999f529afbbf0ad3dd7130c87b05c4549a8e289679b5e1072ccbea0bbfc840c4e1bd49c87ccfbcf5e9979f010925c8535b8285027dbdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a493ee6733766956f6e92465f0f8198e

SHA1
cf94afd2df58c832ad3bed3d3d970df82a576689

SHA256
e616880a7b9a746708f3e6372c4a24943c861f07c3f80e708ff8194c6e1dc32f

SHA512
696d4bdf131a75fe28a91b1ce26a984b0c89fa0cf8e6a70fbd592311cd77781e3296e8c7cffccf4d89602359046330179f08b3823e973a7d00eae68dc330aa84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fbaf7d2e5573e64e3e4fba2bec5bf302

SHA1
b6a647bc4d48b1b73bff95da4a9d5a4f9c0653b0

SHA256
88b807dc623d8936233bc0ea727e2e6ecd305b7f65346950039af3931e3e9921

SHA512
7bce5bbc3a5469a29cf37befbee216329bd2a95226bf204c2ac7d427fac78e28f584a601e7ee42957be161c13ec80fd8c3fe35f3c389798a4fe48ed9cea02d89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
222c6b28b980989b8dc4a707b146e624

SHA1
4cf4af3ebb4183e1978dbd4b70dad17217a166d3

SHA256
0da86cda6965da0cbd9416194a2aefcaac52242f573d92116639a211d858893b

SHA512
ca0926b7da1e9733cc50e359aca01c39412f68fe8f9bba01d41630e6596a2f6a98445ad79c1f5b65e5477106ba79f7ee2578d06ffd472ca0007199f004d8114f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59fcad42f3c491a5a069400d997a7347

SHA1
e2777475e19d434cbfac7006b370a73073d8095a

SHA256
e058a8329674c41af21ace123a5482dc26556208eb121162230415232e252c0a

SHA512
bafff6b2c4df72623aaa36b4d27ea52fca07e01cff2d634a6f4034893cf48f0c14074f95aa30350e2bd09d02894712ab3cea809e2f6317f0fe6ea15630309f30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e10172411595fdd14150c7ccd658090b

SHA1
fbacbc9e019401f50b46efad2989f35b0bfca787

SHA256
b0b583df7936f342fd43ebc543eba21ca8a81d8daf0d6341d08848975bbcff43

SHA512
924c09f3648281c9c95a7da48694bbf67bb57472ef470a92d969d77632f9214cf5ab32c891d25246e259691c4650948ea9a702a0df98ad71f02b8b043b3c5645

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a1ed53ed68496f49fa4de7052dea8c9

SHA1
feb6bd4f1fdc6f53d7e19da7a024970a5f2d0dc2

SHA256
88a4f3767e1f7b73c126b52499a1cd126a5304e217fd1190118e2870db6d1bbd

SHA512
b6984d057130bd3c2cb2eb3f0e27c8b87ad4dc05510c96c922b4b5a1e4597528e16f86d96acdb8b9d6420af2d32ee615aaa834f9868862e2af091f361383b5ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c7c9a319e258a08295bb78ca92950271

SHA1
2ce453862c56a3a345289c3db9f9de4e58caa6ab

SHA256
67612dd585144a824c63ebd3d054b70376385920a10e81a233c697f2bc0ec6e5

SHA512
ed4124876c421280586d6ad7cc692a875db5b27f221999528cfd54c60e4c5758254c36a418ab666e29202d8351c7f4e7e2f575e8438d5a167182fc1ec5a904bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aff9b97862127c6510cf1ec9cc426e0a

SHA1
2c65623c10df411bebc8c0b893b14c47c3505622

SHA256
fad33cb6781413b48028c300e0fd83bbc89ca5f7c04e5ff039174e09eaf02850

SHA512
c447f11301f337f21821fd0b14e00378ac6a9663fddad19aad2f8d9554fb3b9128bc9c63fb0a8fffdb98769bad7b552c26cbe988c0be023a6457e40b65c00d88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f1d0fd6657d20d10005359ead03710e

SHA1
4111d85dc1e1b65893952982a20d607f593ba2d4

SHA256
f22921faf12ff076c467d65e36e3b98b7a1a05c8d69650a4dbe3a68e362d8070

SHA512
98f9ed3edeba2973eca3d1686cbc06d9b5c3ec656eb321d917460158219087f49868331ce4d2f2ff147264ba2d52f666748929deb5bcbab2ee983e1cb749d693

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9baea09ab41c9bafd3d781b3cbd5050

SHA1
ef2d3b716bebad717239c3d8957dd736832a002e

SHA256
6de77207d584263d48906f45e7b5960b95c0e21c3bbabd8a5478f44e0ec3b92a

SHA512
5319a67c2256b97a6ab95d543643c689a5dcc0d3c74b2e432876079fdae93cfaf7d21dcd645eb21a1bf46c1ab0910be618fb5ffa47cb5d319b3631a142b79193

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC5A2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC5C4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit