91380848e45f8656bef145b85904e9c938da16d4f4aba02096ae865c96c09d8e

Analysis

max time kernel
138s
max time network
141s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
07-09-2024 09:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d19b28977ddac95daa271e766d860803_JaffaCakes118.html
Size

7KB
MD5

d19b28977ddac95daa271e766d860803
SHA1

742835a86978b47e783c61ab20f7485665834fcb
SHA256

91380848e45f8656bef145b85904e9c938da16d4f4aba02096ae865c96c09d8e
SHA512

f13633e4827fdb6d6830f7052d91b1ba617e0da24ac78a26f2abce031eaefd03f4c6c2e9bd8ec4108084753cac9fe6f5bfe0b36db76f8dc45108a5a70147221b
SSDEEP

96:SIkswv0HXt08IMnoXKjl63GL4X9U7tIm6DTIBDD4HsfuyxCDeD4XKQrgFf1Gj2wY:SIkswvePfo6olKGmNvfu046uw1aPvev

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000ed780b5d7d998cf7727b170b2b2c07b1f8851029ae0b7f8b24b2c3573e01e1f3000000000e8000000002000020000000693fd3f7a0052c3a840ffcdb9f13842563799de661778a61dac58cc43263dd2a200000000d4ff30c8d9e3436cae86c45f4f09ea527e0b49da1c8b2b2e72fa51b4071d24d40000000065f68f4f229e26d31d6deea82895f9b648f62ecbdea8715df8871ff5eee70adb938e0054dae7ba2bd60b20fcc5e279b67a0d21ef818881d3a4860bdb8114668	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ECDD7171-6CFA-11EF-9CBD-4625F4E6DDF6} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000c94062018ca89c4493ae54fec5f66954ae02cb428e3cff888541b95fee79a7a6000000000e800000000200002000000094f993446022c125910defe701f92d6488bbdbc1a95bc64aff1431587a9c1ce0900000005defc57308696019bbd4950ed16239f7d1e5863175de36ae7cc6cf4a37416b2916443b45903ece1b04c98a79db629266ad7261f2b6ac857a4d23e99667954428b9d28e6ee5949c88439f1bbeec1957fda88f20fc35d2c8523422c873b8b177a997a4a571e43dfa394e903493c37020142d4b251c269cb979ac4b92e276fe48537fa2aca31258776ce3fe23d9d80e05ef400000003f30ac26f7528c11c4b6c90e18c24f1e9b059cbc362c43db27d6864597cad088396bd3bad740e2fa1c44d664f2cd8db662951a83d263a18a46672b1f81de8f7b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0128fda0701db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431862915"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1628	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1628	iexplore.exe
1628	iexplore.exe
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE
2564	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2564	1628	iexplore.exe	30
PID 1628 wrote to memory of 2564	1628	iexplore.exe	30
PID 1628 wrote to memory of 2564	1628	iexplore.exe	30
PID 1628 wrote to memory of 2564	1628	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d19b28977ddac95daa271e766d860803_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1628 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70b02720c16e769a8bc29dc1b22718d4

SHA1
a9072053a49cbfce5cb208dafb6142c726949708

SHA256
e09f11c3a6a69fa76217593dfaa76ab65b213edeacc14544f26f4cebcad00b7c

SHA512
b9906dd46b713782672a8a0a16b80d5e077e75c7ef32a5e8fb1cda0378f0aaf2ee2994c21d3ad76453bf00bb5498b72ca31918605208952a1d18345c29362005

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7fb2f586ad668995f9ffdcb81d4478a

SHA1
cc62ada481f1c5c3ba234097121f93e94b767f95

SHA256
e63278405d2af35b4448e4293543a3042dff0d6eb04e570061892b08c00d685d

SHA512
2a5c074fea78083e57d812da65b785baaa5c0000fe99d319e0888e177128847847911cb91f7d30d1290952f7337cc0685ec019c868f0388ed06badaf57c74483

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b95c308b47af9b58f1e35346584d080

SHA1
223431b608d3bea73d2cbbb002277f15b40ceadc

SHA256
093b021516395c8732c86bceb3fc2601076e5b35b4d7fae23bc357f21271c9fe

SHA512
6ef200151a3b65c53a1cdb9c6cdaefd620629ccc8798a0acb557ac60c6dbdee09daef06ab3f2a8a0865c05fd97a4ca66aa6fd10aa3a4a4d29b487494ba3d408c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ca8b8a2f5dba3d5c076f58728fff127

SHA1
a0f6c29526218c5d8f2c86ae4f11cf4e4df5cdfe

SHA256
9087fa88262a05f6159cd4b48689e896644d8cd25a606c72bc00a3a838a67dff

SHA512
c975b75352a845ab012d5294362b7cce21e71df869a5b31dae4d4ebf1c9704a49ba483e0b93d9c46220563e79691880ce1caebb5a17a36015eaa3f449249cd5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d90f06ed092bc15114ff1fdf273ddc49

SHA1
2ab70c73ab9aa9cfbc340fc197f8b9323f0965c2

SHA256
4800fb4e4f7d316db7ead1273370b00d5157462fcb2e299d6e3f34935462bbf4

SHA512
ab3b1465635b711f9bfc4fb36fcfc7ab93e303be4fa185c7ffd299fe7d28b3266f36784e3b1c08f371d5b8454134a28c3ddbb0e097a502b4a9e29b03e47fecf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd9a616f39690303f3f6c432727b1071

SHA1
8637a9bcfd9d1e0ad3cc645f2eb28b07d8af3a26

SHA256
08a8bef874581b28e22974ad282c5e8fd7e860fc3b65dbf2cfdd421b7efd292f

SHA512
b5b4168e725795665e5e5059e4d8630b6e632cb58f0c6d094d7726e4b346ed5b0dea188bc266046bd38b39e7e5288658a7215c6347ae19e1816c5dd906847973

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32831cc4c821e881aac7a9877a0a9373

SHA1
8b54f10bd8f6a01927e2487aaa3fd94cee579a16

SHA256
96be3625629360a46ccbfcf9f871192e725c2574f76cba437ae6016eb48247c9

SHA512
b52c3f9d331c93ff8db504bb6da14878c60e27dc5c4b0bdc5f1ef9fcc90ac9ebfcfa8dbaa859d6e8c0ab942b5702f82ad86bd59e82ec28778d65ad04a93832e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb94fbbcd12d3d8d0ccade427ea3ecf7

SHA1
7dd63b74da1e262694865eea3bdcb44b7438e7c3

SHA256
d2e972c5842f105efa12c61f22403ccb8f13a04d485c258783d242d003a73907

SHA512
126c3957845cd8e389ef9033517005e1a3e2d6bf23e7e0df185557bcbe74285a64a0195882bf5754d38c42e24fa29b526652748571ea18cc9bc5a462d9819883

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58cd5d81493a9dab570e14a2dc8ce27a

SHA1
6ceb2a30b00e9631a04abbf8fd0151db4881afb5

SHA256
0f99df1c25de2393f0c8e4fc0f555201286078260a0558af96e64f9f0e762e03

SHA512
6a09c31f631cb3c44c435bb0247e22787aa0e2f00944c7586a62d35591ac74d8dd17cc01ec47142c5df4246070534b655ab16c74c9c19ead14f6e3cb160c6630

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6b5147440ce806e470fca6da20471ed

SHA1
0fe29c04302fb204e16077008942d5c635c0b185

SHA256
83707971b98a0180a436fb837df08f744fa51acdbda657c4853313ebb0406f10

SHA512
ca003fac23789e8260e229f6237b9c0e5f67db511e53127ecbe48e612757821bc93f5773577cbd47f5e4863eeaacdbcf3d36f9b68d7e97a2863c40ca1f3ea2fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76bdbc4fb1db4e0acec0510fc5975aeb

SHA1
12adc10572f2e89f343700fa4ea61a661ecec1f9

SHA256
e257732a78082499da15947de2204b1471243b7be06ffa7910e5753878065d15

SHA512
ca6bc942698d35fdf8f68a2ff90087f040e5e5df55a1c66a69c6753d847fcee4bd344ee9b58609660976b8c5af4c62ddfe391526347507f2d8ab45a5288ad6c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fce92a192675c63983cbfa95cd7066e7

SHA1
f9d8335e815a89e267dbdb78abfb2a86d61c1711

SHA256
73e55e3c98a036944f583644f6edf3f081bdec98b053dfaa884f8602c5feaab5

SHA512
5aa87de94e776c2f4ef498fc5a08c00994427078309bd195c71c9c3d701a6192a57c20ecd7827a5f4e671961ee5bc8d471358219f32c6452e4cfa34c7110f7b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea0f382e118cc7c899d57117def4b1fc

SHA1
b68aed7e479b5aeff5cb6bdd5a7913d1f0915581

SHA256
97d705a68b005123b302061a78d2f4d82543208ce03501480f6b10b19230513a

SHA512
40fd3d271b8e8eb35ca176e1409d9bae199cf2b07d61910abc1d08571d41a9585b5dd9feec6b23cc3561f9438fc5527b2642a0e19c367b5b42ec63bc39b2a42a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC459.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC519.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit