891e78b8c7176ff4a0bedcb5a16602ce236b374026f9da19cfe9982838330e3c

Analysis

max time kernel
121s
max time network
141s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 16:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cff5f107991c30ec658af094e1232938_JaffaCakes118.html
Size

23KB
MD5

cff5f107991c30ec658af094e1232938
SHA1

6ccc49d977c75c3c3348b61a4f91788687d8fed0
SHA256

891e78b8c7176ff4a0bedcb5a16602ce236b374026f9da19cfe9982838330e3c
SHA512

10447274b7a8b0a6b933563105ea3ce7e0541c17f56fc0a20252783e48cb39d261b5d931fc3c46d0f15ada14e7184c1c4ec97acffbfaa56bf1ae9e80ef70ba1c
SSDEEP

384:Q064v82LGoBh94vkCTkYehOHGo3iEZNIgIezzi02q3J8q+2QpGlFkAohhoDKtGG/:c4k2LzBh911pmCWE

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e09932bb7900db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000c39e78ab305a7b98a77bfe50d0cd9c46545f8b687116b0fcf0c5b7d5b923c154000000000e8000000002000020000000e20fea5916ec5dcd313d7cf4cc113f9779a60c8dcb6a3a04dfe6706b0da6beef900000005bde2cb9c5f772572cc4f61e8becbb7487aa2d46ecf33f8fbf01d95bddc7aea7f575eaed651aa5638f4bc859c5d0826347c81bcee77028b63525b428ea37089705bc55e376df2f65f49c4926339ea0529c681c847a191f6392bce391a1ff7b69f9a6a46670306604c8bf90d790464a293805fd029c4a7a94987c97d49442b557d89225b6eebdb34006167eddef4779b1400000005c4d7a43c7c78dbc2515c7412b9523dfce78074b4fa078f213517b7dd8f4169bf92e0a9effc13a8a5eddeb3f34426e8ed30bcb2cfd869214074178c77976887b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000214f2119f21b50ea78226276a4bcca85b6355ff8b67d65df008b668c7ba14328000000000e800000000200002000000092f6a06d1b6cbb41b0f6ca538387ed1fb49f7e97fae4aa93d36b3c180d965e2f20000000dee105d64b934220daaf36db0ec940b5b6262dfe7ad1c9c0a4d0791f1444864b40000000728ebd30f18bb16dbe479188769ac9870312d6c483c55d9db02496bd4d39f9ca88b7f299836341f4493e0efc6138cb2c8c9d4212f2ad16665e1565fb0889e904	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431801910"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E1BFE4A1-6C6C-11EF-943D-F245C6AC432F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2728	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2728	iexplore.exe
2728	iexplore.exe
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 2732	2728	iexplore.exe	30
PID 2728 wrote to memory of 2732	2728	iexplore.exe	30
PID 2728 wrote to memory of 2732	2728	iexplore.exe	30
PID 2728 wrote to memory of 2732	2728	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cff5f107991c30ec658af094e1232938_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2728 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f945f3e1b19aa07cea772eab386db281

SHA1
e7421bc2309bc2a13a4d417046622eddb00d712f

SHA256
0c79117c7d5b99c531929ad753109ad25ee6be34cd42954785166dd38564b921

SHA512
b345cc61ffbf817ebe13fcd4292a32a9a671c1b308c1275b4b8d36f589f97fbb1307c202163e4a9faeaf1f9d4c9d69b14886016fb2dcf25cf72c6a7d69a11f0f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3953a8cc7294d746fdf6194f95deca4c

SHA1
3678a5ccb223cdaf260faea529814ed1a4de96e0

SHA256
90301ee0b971c08fa2f4aacfc0abecec371fa76a845346e17ef340fec948c7ae

SHA512
c3c5b7dacc3c51517913902f0ee14a3a60333e6f8cf76d73266c5841f38d2043e93ca27b217edde9e4922977e756fac994f9075419deb50894b1987d0ac82f04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f90dbf56e9f99554b2912d77501dbbfa

SHA1
7d7155cc0b52e523e8f1be1c986eebafb5583ccb

SHA256
c6a1c35139d9a8271dee2e336048c1f86ec2c914b2b1dadd0ada9a06e170a712

SHA512
69c2fface38e7ca84f8781a07631e6dde1871681ebac94b4ff9c81db5095547a9024ed0ca3fe00e5e72bee40d6cc08d7bd98d3f5a7ee041e4ebf44fe5bab1750

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eccbab8f455a3158e6294d7d045d20f9

SHA1
31ae797de15f0cf6814f258c6484171f92628427

SHA256
f0bd18ad06038efb992cb3bde3522e4f405a3ed41c21953d85743eca829e39d5

SHA512
9d918b480303167ffe28ef087a413cbf517616d50bb2407541410782f3c2b214ecd4a8ff1e46746f2ed788d556678bd8c1e9e389a2569e5d97b5304afe745b17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc01e889093ba47d443c080961386cf5

SHA1
0dde13f53b8a2ff540d17c0e10c5ff4f5e57953c

SHA256
13991638d9e207e3f70467a4c887f16be06b1f2dcc0b1f04f4dc90b0db6a31a9

SHA512
c8554cf5f3764509babaaf7fff732882b1e7147503e69ce7eefeb3e07823f7fcaa1d29938938cac9890e587440f595faa4e876abd0a802ee6b4b11059aba575e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a7741ad1ef74cf87fc5cb4e1f4d11be

SHA1
a7f78d621bd32ed224f9725a3d46b64d93a97c57

SHA256
6d7932e40ff8c7fc60dc8856d5efe6efad27b27f455b09703db0c62faa7582c3

SHA512
9bf65cab7548c07deb4f9eb7f2e44cee7cb472808175b1a3340859daca71032e176026f3c6768cd6af53cf67aa25abb157b944cae5f15428830e1120877a0a8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3587734811474f75eebcab3e804ad1b

SHA1
9781dcca0acbe4ef04a2f58c33733b2c8ccfdaeb

SHA256
b14bc97ae1528438b217b4864f03834ed24b56827f571abb515c617ffc65ad0d

SHA512
3bafa77b4f2b2214fd0dbcf33f96536ec6dfbccd7cb17698d9fd3506819f715626805cb06f6cf063d03aec7d28961bc27ead9ddfbe504509c85605ff86c2648d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71a35c8ecf92cc9f93edfcbfb187f61f

SHA1
13cd1407b8594951854165b1b0a8c1f8c17ca7a4

SHA256
604c7b09304a8923f0dcdcb36af4466abbccf7a4ab6eb51b3c136b5a3d82289d

SHA512
2f71b11987a8fbefc647481e9961426326775074428b8882466d2c8da8e8451a3df250c09b99a85906726f4cd153dc19d9db461ad2c9f79fc9f1e2e3bd90f140

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c490cd0a4977d2ab871146ac64b5045

SHA1
89489a33595824f3890ef6d902c7c75456f88dc7

SHA256
75f2aa2508b6173dc2e92c2f8ac6f84acf79dbba69fe4f0d423ac251a1f82561

SHA512
62ca047466cb184ec2dc161039ee02f32813e933789a0feb6eb959d0b09f8efc2403772e8306698038caf2136dbb2113cbbd2bcf49ed4ae25afdc4900808a3a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85547e1c09d9d57634a0d8b6f5274eb7

SHA1
727c1e246c68db09b469c4d3561b80a89293bebf

SHA256
2ec661b22885ab0a0feacad8b1d5137cafc7001fe3c291b97f57cf680ef1cb63

SHA512
fcba75a8ad61832d59a74255fb1970f0d3b6e3110f29e7cb6c91d9c394ebf317c946cec676fa89c6537a70f25e4d9a7bc3c48a3da1ae00c8dfec1b8a7fbcb536

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a99c0db82534c4eaca27405083e8842f

SHA1
da394042069c593d3c884648b6b0574bfe207975

SHA256
8aa0a56d449f56e8c7450e6a3329385b3ed7848438ceaa26b3ba133e21b153da

SHA512
e29d7f6dc6ac0472bea03b493459d3cfec7245f6ac4eebe7393c9bf0a6db81f99dfa24836455639ad55ff72d308dd1ad32697e0804d1424e40e68ad787767a5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43a4426438a24a05c4001da356449d7f

SHA1
e312fa9a122a692043bb837fc6a4ce2a04fbf274

SHA256
2d0deb31ea7a9c0905a70c9e25339dd2c8c1c4e8422350e873d3c72bf5f78316

SHA512
88b0b828919c5871a2f7c46bc90c236c88a4843fe9908e75d08992f4ca2f9534e9a08ce92d99267534bd2e8a2bc8674de8daaf9935de5536167451d6366f2093

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e3cee907e416acd49e4d39194d3a0e6

SHA1
59e466ae413b20b390764ffb03c8ced93517d77e

SHA256
86e85b6b4ab2bab4a7c797d2c325cbb9cfedf2e64d964d9ea71cb3d57d3a508f

SHA512
59ade1932eeba4f3c5d5b4cb223f52f4526518d0e074ab8d36a62eb06830b0ae0bfad86f455429755223000c5a0efa0558fed0398191b004ff81fc9c58109683

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0a31b0b72f6ae3e04bae8149f37368d

SHA1
89774c08c39e812e7a1902c49f1aaec1ab9e58a0

SHA256
c71b9e8c3e875d1f24dc702fda3b6797961026673e3bc5f0917bf11417cdb571

SHA512
c3e8aff9fd1b10ec95b94922f4028f324a1ea181247c18b9b145fff4ad6c34b7a79608a2f2795901704a8354cc39ea49bdf8b471543e5c3e0f7c5126d15e92c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94e964cdcf5fb15f8eac1b67618b2e00

SHA1
c81b02c2f4af9cf58ce930cf3e6f8687b10b15f5

SHA256
1d0fa2516810c28707e284a77e51e3fc70f407174b41de6f8f38158023a9b28d

SHA512
93f4a723d6df981fa2f0fec5494183c5eaae98e70996a5805881197884d2c36ecd7e35d4520ea8ed8689bf09f70154fa2ce55de467c8ba04b773574ee519af29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5892175d9bda64abadbbe9f74062c4aa

SHA1
7d631ed330711c1ede16843e48b8decc7ff2779e

SHA256
2ddfe6edf92faec90f32f79a9dedbd2228fbf5bfa42c47f9259810b102c2ae72

SHA512
2dbcfeb5d7b30f0d33e9962d601e85809a7301ca2928a80ab120d5b50d4600300f777f1ec7ea132ba34be3b0befeda75f65b22178ab3e3caefa510c24da708fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9428.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9765.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit