34dd3b6738e9f7a20956a4285755ae0368436234464a775def899fbc163ed568

Analysis

max time kernel
118s
max time network
134s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
06/09/2024, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

cff6335b528643e0bd87ed3db882f693_JaffaCakes118.html
Size

23KB
MD5

cff6335b528643e0bd87ed3db882f693
SHA1

2651680e18a4a6931e163524c33c83156b9fcbe6
SHA256

34dd3b6738e9f7a20956a4285755ae0368436234464a775def899fbc163ed568
SHA512

9053b03ff6314e676844efdfcedbb9f9cd581ebf6b4fc808a6ffa62c601a06b45d9ed40a0d5892d3b2394767c778eb24c544a7f74701ee2f57847242c1ed6baa
SSDEEP

192:uWTob5nexoqnQjxn5Q/UnQiePNnvsInQOkEntgqnQTbnBnQBCnQt3wMBvqnYnQ7a:qQ/pZ7

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F91242B1-6C6C-11EF-AD31-F6257521C448} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000a6a29b96de67f3619a306fa54928daacae696018188bba11afcfb687315b2758000000000e8000000002000020000000d28b4d4b5a24917871181df1556144506b62a75496087014db6026a6a8c9d9fb200000009bec2d00201c349f29796ce5f53671de96f004c2fe6658a4d678859c5ddc446240000000ef16890c1e826d8b8c42b39c9c4fc3649c8fbac1d052c38af146cd5e8172fd2fdebcdaa6d1a79bd7f9b21fc80e4496c82fd10e66fb657699660de34fa78d341d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b03543d07900db01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000002198fbec25d9a04d9db03b4010cddd3457ad4e0123ffe960a1352d5384205974000000000e8000000002000020000000ee39b03cd926668a04581a13a41d8547be4b4bbe8ba30c4473add48f2bec82cb900000002de72f55c08bb3e6417b2027fc03059015877d631604430b8c72f924372c0b523b843b3a5e0901d90da295af6a486a0f14a8806cbf0b07bcd5f8705156c9664de7a99b8beb570d8f070b8ced89ae88c1a8df5b7405219a5691645721d3a4f1821cb4da7dbd0b82ae9623b33ebd1cc8b3d689821af97e87e315ca35bf809e8a0de2c5b5baea9e12a9bf64f40623593f36400000009afee0800cffb31f3b52b120f4490e21c47c1796b152cd26f8fea53fa4758ac80231c264454e68722b1eca1c434759666f514633924539790e1bc459cedce4da	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431801951"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2412	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2412	iexplore.exe
2412	iexplore.exe
2876	IEXPLORE.EXE
2876	IEXPLORE.EXE
2876	IEXPLORE.EXE
2876	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 2876	2412	iexplore.exe	30
PID 2412 wrote to memory of 2876	2412	iexplore.exe	30
PID 2412 wrote to memory of 2876	2412	iexplore.exe	30
PID 2412 wrote to memory of 2876	2412	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\cff6335b528643e0bd87ed3db882f693_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2412 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
846aba87fcbb1020ce496cd7e5aeab00

SHA1
6e521c5fce8bb328b4b80ffe42ff13e7334e997d

SHA256
a92253c520233bc369392a27bf52427773c71055d63e42be8eed78f68f53f919

SHA512
1948738e69a56ea61570d1e1a2a0e02bedf764f38635c07e2890e64c7293783a07bda9c6af9c4ee6e218f379cc167cce38e6c3470ccd1b441678de66cf191a86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22c283acbaccc8266d1d7ecb94017f62

SHA1
6196f11be4d8995620a14b0b373586da15ba61f6

SHA256
25c8cd7127f8c87962610b5f2557dc4b4275468984f0e4457cc8676df39d7286

SHA512
e9127d808ce04b6e83e8c11e6b1c732b364e9c6eabb710d3f42c72e736bf9d50d08d2b2c0e60a27dda4c403d0237fa6c6ed6eaf5e00fe314626a4ce744315911

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb6d3def12fe7e583b402182f656cbd8

SHA1
159a28c81bae3130448c26df03fc9f90846b8d6c

SHA256
d44ac7b30f26f7b65fe26eb8fec0a0ad685f3cfa17f4a775ae5b9be7ccfdcbb7

SHA512
56cac93ade87ba70c188d905c489c57d4b4302982b7958922a468e73bc864e0c13f04355a9266f7f9a8081e6785c4ee140cfa72ec5138b1833d8f5b7912ef231

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f02f4dc798fee688ab5820a592978d5e

SHA1
082560e61df9dc39e70df0630bfbc54ce2ec7970

SHA256
2ad4b8b6a5d3c2979dc827737c69055706e9cf9bf433950592d4fb4382c45e24

SHA512
c24b7b926f29cfd2aefc5b92f49ff06dac6e9c444606316172f8c7e2bf5c18c00a0aa00fb0e01e29049263ce77602a7c5f44c8b8f056060646b112389e8d2d3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2239267f690619ba58cf50c1c9ab519

SHA1
c26baaec9024ecbe9c381dd6d0ec82d758328a8a

SHA256
f9e89cb3adebb6cee0541254e9ad2c35f18e92acff6f955c5f567ae1cc2d2720

SHA512
5ed02975f868020da430743d82f01dc6425adb8360a4272cbb409a0d0a7dbf8f7f95b8c0e901ec43166e51d9dc547ef58ec0bf88eeda9301aa9d9a67458026e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4ca9d47b21c8d365a2f38700a922366

SHA1
7770813672e1ebd17c2fbb7d1efe0ffc608ed8a8

SHA256
aafcdec5bc0096d1e5324f9d10bd938435fcac340552fb446ad1bdc15680c5a4

SHA512
1c37c0de9d5495df1f8f4edc96a3fddca38c0f08da392473a55f123dc2ab2e26df948e142ce9af7bef932c5e80a3c0c87ded1550a41cc201df1a9b8884c90c6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10e597e86a51adca64ae8769c6e2a8b1

SHA1
78518f28fcd46defd9c74b3063f630ebb1a603c8

SHA256
96233b687697d53c48ec2997a0f2302aa8ba0e54045873d2367f41377e8741dc

SHA512
399dd7cbe82c212069feba9c7f45caf7ebde5c48c7a3d98dd469e30aa3722a0750a55c1e54b12fa04186f591c74bfab2d6d5491322bd87e5f7aa35831856811e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d594f15600a665868dea0e31c142dee6

SHA1
1e976ca4970670f2afeb701d0678563634d0c677

SHA256
26618180ed2a7271842dd0c1f8fdf80ab73e6d4807a71be0ffaed8fb83609b4c

SHA512
34acec1bcdd8d73d26e67183f5551ff0d4b495e36d78d46fd29bd7ea2a03d0c00a391a9bfbfaf75c2077fae6fa0f54484dcf5968386ce399c512b01f80ea731f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c99fb4b2a7c53e6fe1eb6e48426dcf8

SHA1
4415ec4e69f597db517fec88cd8b33e170e7676f

SHA256
b3f40fb8a73a6b07547c1f0303a0b23e53afd74f7f67889e0aad8fb3998d8fc1

SHA512
8181525efaa02f84c051945400d9e75d9da4c2c2903dc3022b8658d563f2489995c29119f595b77d357c20f1c533769b43f7891e481ea6489139364ea80beeb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2aa0d7f9c027c4a001a7a8167e024b21

SHA1
2dd965d5f208bdbc4f3a3475add9b17b961f4dfc

SHA256
33a8fff25cc50409fde2ded556c6235773a38645cf748981d30a1812cdc6199c

SHA512
06b1e123902b90be996edaab05162248104b4ebc0b0dd50dd29c07254ef9e2fc0005205b65033e4df4a1734adb68ec8ecbb7d579d1f8ff03ed0c1fb23ea74516

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ebcafc1889162dc837c71738e7ad7e4a

SHA1
38b3b1ae6497dab6e7c223f174833f441b492067

SHA256
841f534d7a07dd400adc4ef24a090f8bff7e427f3a32980ccd278b1f430ae7bc

SHA512
f4a9b259d541e1d93e3a869b0cfc092b405a2e1a58491c623927b07e59ee69189a65f306f70301dd4c1ed493be4fcae34e3a4be10abd49da27ed1eb3c390f655

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b58133bac70272cd1e9b146eabfa60c

SHA1
b89805b58da2ab03b7918cd2ed76bab97805a441

SHA256
872bfb2f596b9803e5e96ee6f07817dc5cd7b62e3e39f014f6966d496e7c655c

SHA512
c568cba54c73e48be4c4bb449ab8344f2c956296dc277b95efac42208228f47b97381e5d75e01bac206c5fd3b386df85e94e8791444dca7adbfce23454287a89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75c1c6b6b683072dc8ff96af0cefa43e

SHA1
bc666c98a5302a4354dd7a9c2a3d36f1ed356575

SHA256
4e3976283950ba9979529f9dbe722837e1549704990bc68f81cc3c6227820082

SHA512
50d74f6ce19773d16cf64d03fdb6c8ec366041e960acced659ca37b99c93e36a478eee7de19bf6b5586fee067cc4f9a8e191c6b65cb3eee813672f6375a11070

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
972126969413e5190b45a8c14fa391eb

SHA1
57f6231dada90f4523f040f94088a7ae18d3a58a

SHA256
a81520e70e054d394740c28673f6c5a80678fa122f72ca042a488a8a9ec0cd65

SHA512
3d4f0cdb6819d46ee803218f85ecfed2ceec45f728b9b4d1db9df5089bff0856e8486bf2e299dd2041b2cdf23bb34774bbc5b1ba253db649970669df7aab306d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed5b23d05964476b0013bb944e6e739c

SHA1
d2f193a0b21fc3bb405b749ea64969f1662358c8

SHA256
8241a96aae8a35740790c686565959dd66a9426cb707583d3bd449a34c156a2a

SHA512
6a87ec360ab70efc5542f522177bd5ab7c03b954b4336c650d91b2ce368424d4deb6e04bf3a93e9ceaa4b5ed33ad60052484a8ca9df4825ce22c61545ec0d138

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4E13.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4E84.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit