cc534c99ba678bca87eee0c245698063586a243b6819b995d76de4a760d0a8a4

Analysis

max time kernel
134s
max time network
149s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
07-09-2024 21:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2e2143869c7fbab2f3ba57b6409e5b0_JaffaCakes118.html
Size

10KB
MD5

d2e2143869c7fbab2f3ba57b6409e5b0
SHA1

c9d230f580ee5a76ceef5c1be0b3591c5cf04b2a
SHA256

cc534c99ba678bca87eee0c245698063586a243b6819b995d76de4a760d0a8a4
SHA512

d7cff868bac7bc1a92c1df173d79b4389d47005f1359c2c7ac87e39cbc9dd68ba6f5c623e90e69ebd37c527d5f919b126df4372fcca12f28e2eca3dd63e03a2b
SSDEEP

96:uzVs+ux7IMLLY1k9o84d12ef7CSTUHGT/kny16uprxJ7g6teLP4vJNlVHcEZ7rur:csz7IMAYS/WyBr/7teLAvJNPHb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000b04ae60e6263cbafb3459abdcea13a992f055d451557a540b13c84fd55e7484e000000000e80000000020000200000002d8b85796296e5fa776eb7a81ef69fd6a291b23aca50c58414e4ee90cf1eefa590000000fd5110f1db7d4fa4962986940cdceb6fec037164c889a29a4a80e496ca68f3b2e7761a94c90cfe6a62e71d48f19db6de2240229550694e41215b896db456c104dab2b3856dcba2ba4692faa6b99679137f91491c975f440dd636ac961e6eb456df73b52736a9ecf6ddea775bf11320e8bf6f3849c7dfc41203e00fa48dbb7c3ba90bf36625e35dd960a9c56d145be5e64000000080d5abff65b8749e4a00b10396214380e0e5e5aa06d0c7a1fd37fb21fe20f157ba740e13c749c98a5318fe86733785c0805871b6d6ad90ed0d12ca3f7df9e488	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 202c7dcc6d01db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431906735"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F4D7BCD1-6D60-11EF-B961-D22B03723C32} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000004994288010ddf3cc8efeaa1149d16d626b6115c103fc016c9521aa1f87cff3da000000000e800000000200002000000060d84df6e337ac57787b725bf75dfc092bacdfa0a229bcc5a3b62e061ea7c835200000009eb0cea5eb30af9971f03102f478f10b919292e7c0bb8d3b340eb1c26e2fec8840000000d713155c88c73d2dfa6749407d759dc11900a7378bf62ec88c257ca2b86dbb950dfb6cb2b5d6ebde3c6ad1af9c5df6a531e78e234ad91b7d54ca430dd06ef02a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
784	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
784	iexplore.exe
784	iexplore.exe
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 2440	784	iexplore.exe	31
PID 784 wrote to memory of 2440	784	iexplore.exe	31
PID 784 wrote to memory of 2440	784	iexplore.exe	31
PID 784 wrote to memory of 2440	784	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d2e2143869c7fbab2f3ba57b6409e5b0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:784
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:784 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa082f5330a421eba939f71bb44ffffb

SHA1
9d0e4606ddae357bdcde882c002866ee9fbc49d1

SHA256
83995e7d062513d0960602da244a2a13a8c05a072053924c2066e5ed99849c82

SHA512
a70a84113d7677787d0b12d9dc6728b5850a23b42bdd7cfd9d3fe5053d4f1bb1ce6b32fe332a2fffbff2b9d0fda4679c3509f80bbf236a2280febeff81ffdf7a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8988b3ee62a9b083aa26a9a2ac51f109

SHA1
a9b5995858b1e904f44c41432d22dfe67ec83313

SHA256
3525a3b8f36400d404473e8b141128ccfa919f527ac1908583a2cb7d31df5cd1

SHA512
ac6f004846f62999c35d691997eb21b88b8370abd258792e227283ca1b88b0cbf34350a471bf57e567ccd8a3cd1358388b4960040a7beab7400e284a0a1c92b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
220214a1be565a6a565573599ee22f5e

SHA1
0fc2b2c337c384bbd91e84e770499d711207b832

SHA256
2dbbb0650e3e07e590c294e626b70335a00815fd779d66a049a82a9f268b7275

SHA512
c35450d08d3545a62fbe809089261c1ad14fb6ba3c851ada323ec9f8736e84b445e8573ebd6aabe69f47857e312926cb236e7ede6ed3bc7c997acaa53b1b20e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07912c2930c4f1e1b4adab3ba0a00754

SHA1
56b887c2fb9b065eff3374b0a711e6edcdb9384a

SHA256
18385f8088387ada682a63cca46072dccb1fa9294dde2c41b0f86f770784929d

SHA512
ffa56de0c3c43d0f6d27d27c0a1a859fdfe90ba68b0a1ebec6f3c2c60093ad8f40ff97b5412cdd40c47874dbd14362cdb0855622df38107ec37a276694356550

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54e899a48eb5d44256af88d76cc43b1f

SHA1
b16feb4022a0c5f424717a4ca6cdf15cfe712dbf

SHA256
d416b87953d51c8d726bda77ecd23faa821c38e61d2060b551d53c513f58aecc

SHA512
ce500eb1177a7109b02517529a0f55ab4ecd0790d8b844b2a8fb18214dfc71b584141c3e81d0bf6d733673df631fab7e04acffbf70e062fe080b502871e48b55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70d2e59a902c2d1cb44b99adcdfc61bb

SHA1
b29685e4a2d708e565733f335084c790f789b27f

SHA256
e8a5daeff4fb49cb29df9cbceb89d6bbfa0fe2e9d98e9b777e47f23fc36bc4f1

SHA512
c1a78ab82e65d5f29d10a2346a7b6a568b42d4297eb1c80600447d17b0583e6ae4cc801b723b220285f60d529f05e2264e3077ce7e8788e13921919032acdff3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1054a7d124826b9cc52f0f9a1960ae83

SHA1
2da9c37d8f70af1d320dde9170b1674c0f3a7aef

SHA256
2de0c6b5ad8c292d162de8a5db7f3387f7f9e187c139d7640231c9ee89532e08

SHA512
ce75a99a4709e2b8cbb7218288738e5a6407564e6b8d7a90f66b5cec77c4cc6367fe1ef8f800a8aa8c59300ad92e22981b51510fe5b7c1d671d3ecc506b05994

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e3e337ac59fbbd5c8185606e81d0b86

SHA1
a1f2744049bb2942f569d31ec351409de7a1e641

SHA256
cd19d70c6d222a425fdf33c681a8319bbfafbaba1cf705d59d3329ecdd238abb

SHA512
e4b9bf507162bf3ccac0a97442049eeae79f939d854151a36a38fe70167e588a9bb55f254a8f7fd82dd3cc2502f43e11c8b17992a88e1264461922f9e99901b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2c2d0d48464dd357e6520bb3db4ac9d

SHA1
d8306e52a9e8c986430de56dbc2291b98d9d31ca

SHA256
54961ca8eaaa250eb77a7806b591a3eda155d8b81496fa900355ecbd56506341

SHA512
172c625d731ba82879c01199e288e1f05369551db3ab69a4213bd0750a5fca97f42e10e2a0d212554774609212f2ae5a50c0193db02cfd0d5c16eaa915d0ff69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f5e7c31176cdb9a8ba3e08f8f2370fa

SHA1
f76aa39045f1c2a7600a7cff60963dfcbcb863be

SHA256
fcec1caa8aec9e1ed76aba7126f326e9380eac72522b563d77f3bdd27faa51ad

SHA512
bbf32313f012a4d5273ae350301d5b8a56ddbfcf9fb1a9c0fd126e25a3dec952b8e15755be67be255c4f07171b70fd2a555e2ce6c26ce1fa8c778a09ec2e6dc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df00a3cf3e5201aaf4e6f6dc87552b3e

SHA1
12132291f13df66f735ff37df31a27bfefc35fa2

SHA256
d33bae74623653841a99e0d29cfb88b6880610ab25bae26c48ebcff517c866d6

SHA512
38b62220f9a484f52c0e897667ce5e29fe88feda36961c70aebc2d6a54f06689cf9605180f2af4297a7e501ad59aaec71adaea950caaaf267a37366cc023ba0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b0dba1c8d6149a1be8c6cfc4fa370b1

SHA1
6d93fb97f581d17571b7b3904a99ac4ca855297c

SHA256
b59dae0909e0ac939158bb314ed20bec2150d51a51f54f0271020336edd67749

SHA512
61af676d31bd0775019f38d1fa181712d200ee87cf8ba75d4c766884e1a322d506cb300e43b6d23c0596a69b91ccab4df6fe4495f8a88b2972811d6d9aaa25aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d6792ca9c8cf7c3dc19c23a24ad8a69

SHA1
b4c0f8be8ea86379ceb16dc04f8466e1f6dd0a73

SHA256
36952e84368c8f7b8c0e93ee8523cec04f41c73a8d8ce3519c2c6de0b80837e9

SHA512
2d7346c957dada3cd5c7605afccd16817888821a6cf7232272df8dc12c022653942cbc9369fa342b0a2f02768875a7bbc0f41f34c9f8851b2ed65f480948a9cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bfa3d7144644554537b1349b196433f0

SHA1
5654e4c71c012720e4c099b265f66b373119055d

SHA256
262146cd26a307eda0aca6f7049fe5333b433c2cef3b379a71e12bfa1965315b

SHA512
f48c22a31ace5b5d22998bb48c02de0a478662a67623e66e9bcd108b35931af352fc25c52bc5aa94cf45a7755bfef591c56c5f1b49da6390130188749e42a379

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f799ce66f4737675f6f0b808207141c5

SHA1
e18583584e2362354aab3979bcc53a072a16e898

SHA256
831789768756b43cedb4a185093d7b9bbf8aba56c6530b83082690d6c11b3934

SHA512
2cce45bb9c868a6ce8cbce83d45d2a54cba59b83ddda976fbd6dc00f6b2b17ffb9dba36a82d268d7bcf23bd1278f238673f6ab8a5584887c5a76298eada37c4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bcac07fc013f217b2efd73ea0c25ba7a

SHA1
573e1d46384f598e2add0becf206139f1e3ace89

SHA256
e5612cf20fb1b98c6bd5402ef5cfa244caa81063be5405f3a038a48edfbc3fe5

SHA512
cb4958dca0c3c0ae69a01467860f1ed5642517c195677375a8f1a9c6cc434be246c5d45381712cc8d50dcf9010d325b3e87453fe7b47f12ed640dafc4f40a5a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab243.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2F4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit