35525770b9c8c6343955adb33a0ddda3c575fb99cbcd622a9704c5bc1333370c

Analysis

max time kernel
122s
max time network
141s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 20:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d2c6046e4667637cc139d7194680bc28_JaffaCakes118.html
Size

68KB
MD5

d2c6046e4667637cc139d7194680bc28
SHA1

28d022f5c54a29bdd3251c0fc79b2f23e275f526
SHA256

35525770b9c8c6343955adb33a0ddda3c575fb99cbcd622a9704c5bc1333370c
SHA512

5545e84952f06099f103c5d62a3da2a71b51e02ca43e925c1f8ba0931340bae79eb179a1d70ded36773a79be61755655720c0762d55cde3ae35c324dd20d1aea
SSDEEP

768:JiMgcMiR3sI2PDDnX0g6T2eiYoTyv1wCZkoTyMdtbBnfBgN8/lboi2hcpQFVG8sM:JU4ATcNen0tbrga94hcuNnQC

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431902755"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A9664951-6D57-11EF-A0E3-4E0B11BE40FD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f0000000002000000000010660000000100002000000028b7a17e98dcf67dcf6681ac737fd54d540b1c1562483dd7263981050b798d4c000000000e8000000002000020000000748f54ba9165d80affd741bae1c445280fd500c8592c6d75e340e512b8d37356200000003c95d3ed012dae09b1480fe0e27586f500344579d6656ae6baefbb0b268ddd7340000000b4281a8aac93a3f49832d7b2b8594783084b07307ea16caa0b0c2b6cd45ece97141eaa7393ffc74e1dd99d7f59ce7b580e862a9e9b4d985801b107e900a7081b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60b5b3806401db01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000cb9800af5581e63c6940145f6bb848649716abcb190d2bead35881167468a809000000000e80000000020000200000004b2b105e6a2cc42fa5dfdbb7cbee4c7d700e30f2c1809d759e5dd757cf22eb54900000007e3dce0af712dd24798834c2ca79fe9a15ebeeee7ea1ca1a0b567e44ee9ec0acb49a10effefd7986a8655c29b22aa07c17ef836846cccbe489be9596bb9aa7f369c26b99cad9902226954b43e00ed71da68d1db2e77e8e9ccc4e6a01f96fcbda58736e02c1b5eb3572cf3c2e305557131d0d05a14b0f8bb177c30d14ce294c6d5041a0488aa266d41436ce5118c51a98400000005641172d37e45a4c93e917c397c35d2bda59bd064733feca5afb0e55e10a0e85c54ce14f15c3069f3867d98c0ffef688404ce1dd0f058f4fa6d7053da20ace63	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2692	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2692	iexplore.exe
2692	iexplore.exe
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2688	2692	iexplore.exe	30
PID 2692 wrote to memory of 2688	2692	iexplore.exe	30
PID 2692 wrote to memory of 2688	2692	iexplore.exe	30
PID 2692 wrote to memory of 2688	2692	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d2c6046e4667637cc139d7194680bc28_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2692 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b08512bf87ad729d3da91aa1e43627ed

SHA1
0a5461511afa1c5130496c43dea0950b4517ae40

SHA256
b8895a569aa2307c393eddd585b55d0ff825786af74423214be371d5e3ca6f25

SHA512
d500f2cdac5e915218e0889df81edb9591d3383a2541ad6569ccb1a2e80e6b2515c9457561aa78de93b8db7bf2719e26f9784fc7feb159c982cfd42e68daafed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40b72a04a968d4ce46971c2d658fadce

SHA1
c30ec479c04d900968ba55e5b7004f3d8e449b48

SHA256
d47002ae5f82481ff8936818625532bd4e9e94aac3ad75a12e6eaae643cf4074

SHA512
0f5a729da34b6313fcd72895f8b0e2306a582482f00bfeb21b6c2b1a787f40ba55ce26b57ae6f9b23c7fe017727e8156adf2ed5d1d3d923d2454ab882f2e117f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d02e4768cef1def58d8477096df8156

SHA1
9ae5f0730464f7ddf52322c14b61b665f14364ee

SHA256
6bdeccb4a6233e39077d66202c43043d6526c4238437f1fb598453336b4a2866

SHA512
5f9f8ff01c4de0df36e7aad05b96031b22bc0d6181510db4597947ebf0aa5b23cf5aaa896f3f427d450c1834dc5e9b685b6d1c68a034ea0d5c562b3d2526d863

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
defa7ac89bcb73a3ebb665b4de33e69d

SHA1
8710dad7f8f2b261d5b5b011475133170fa1f2e5

SHA256
09402051bd7e76f70cfd05ef2c91d42561c7f3c95ce9f66f912f3e5891d606e8

SHA512
1f7f477dea4101cf2e62ad8311d0e9f894122ca3acd8a151f31395623346fe9b6c3f7d7a449383af33b5bd2c537206f99fd3c266db3bbd1c6c1dbb8e6a5bcd7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
304b9ecc0898a14a5c836caecdebc312

SHA1
58e97adcc7b7b987516b83061d3aa0e60a99e2f3

SHA256
d260756e57ff00ffd508c774c60a06f2d667e25b4dbac33055b95a3e4787f68c

SHA512
62cab737a3601decc44c7cd5a002bfa598f4eeb66c9ad47dfee5d67f2a7b8e84f68832ab2daed07418fc0818b2f4345f3b15cc8d8fbb45fd01cecaf55049968d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6bc7d206af74b42b19ace6cc0b7c0b7

SHA1
4f8f56d5a65c8ad557d8d9b9f1a4c9db2f8c72ae

SHA256
6f7d6f7fee92477c557ab3e8861ddae10a6df9527c874798fb1a81ae78169fe3

SHA512
0a02c3edba62f6e32fa95d8c0d386abb26f2caa15c877eff4777da7aba5618f13586a9a5c8f3df3f59973621ae9bef5451b5934a005c76e7da7e554500a43b30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41063c5e167dda3f34d2b11facc89c79

SHA1
7dd91ba13f6f4b421fe5561a88b74efc20460a69

SHA256
6e6354ac1e8bb8e63c098b087ad7b0efe128d8cfabf68c5a3e50009e95bc7f28

SHA512
f1f4473d9f42f45d007b0fd478ba1f10fbc850e311cc3f020dbdbcb930515d8c32fcf880c065035ce65a3e9b8abd1b0b2d5cfe2f2917e5364652d6600716f7b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df03409aed6be0b1c0e057316e4730c9

SHA1
3ad62de0a2f81024aaed2e924a35515b13c9338b

SHA256
4000e3ae0688fbe6da5bf3e2ecedcb991f444709c4f1d3077c8f83f1df6d0a46

SHA512
0dec3ff1a1f6d06a2a6e6df848e30a5e9645f07587206d6909561449e70ab1c05e6f9ca8bf9f9046ae205a5729e1422a5ff6877d733c5b2ab5a37c869d4d8e01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1daf31cb2e915058ba658baa7138725

SHA1
8ef15117aea25b24790dbd8f1c8289a5d97ccb50

SHA256
8ef52873146ae59a36c8397eed70d0837dbe845be846caa5a29884bc224917c3

SHA512
a52d98b7df67e3b93e5f45215891a529ca6e577de330aa0fb3ebe1d9acba6a590bee150dbb93cbbf05a43e05aa7f6a419b647abb52982f9f90ded9ba2a22441c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35ada4afdafdd82a2d23d9a48a3941da

SHA1
e7d8b05f17d4ba8a1510c031b82451f250ede0bc

SHA256
467418faa0eef9ecffe3dd1d8c0aa99e62ca3f624c055f5a45057a6f01c0d725

SHA512
d62f307777bc284f0c852c6c9198330c5bdcd4a0229338247fb17405f8134536f6d618e47ef4355f980c909165fceca858e5ced7e1ffb483006abd95e6068dd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85f75c5a69077ef4a265abfccefcf2f9

SHA1
2945981191cfed079d29c71e62a5d2398ceabd37

SHA256
0718a267f04aa678ebb072d99efdec797d3dc6fe34b66045bca5ea3524948332

SHA512
15ae9fbdff723fa2294f74b2e621a9feeeedeb197886b4e6073b77482a78d88a88df3e7e254e4550dd56d42d28dbb43dc5a6afc2030b3b3f3956b6f8c1346ba0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad15b42a5743617cc0c0f04e17c66f81

SHA1
cac8a730f2e9d5328c0208453a7d937e4706b667

SHA256
28b992c36c38f7b7146eb2493600baf3261630ecfc5be2b93da4529dcad1acc1

SHA512
776d6897727418e2680ec2c0d3bd23d1627fca7edc0f885df634f76e5158c7fb668675c753aa68cc336eb4e581eb8a5feb2cd23a1e5f2d621879553be63225a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff45f547001efe1e646c30e992a7313e

SHA1
24a5472f4fc839b6917d95fc431af6a44f99ca4f

SHA256
df0dfbc686a16b9fb61ad177adf2129b89488fe355126e02863b45c4cc0a336d

SHA512
57592fb8286a4d680f9bafa35d3d5beb7cdd82ca41bcbd77598c09c6f31612afb8e987cd829f2f76d2511dd1eda6d5e8f616dd955666164890dd4678f4c56bb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79c07d9cfbecc5cb7b4b372ebd81c006

SHA1
de7b40ad2ca60cdbfa76419146e94506111ab9d4

SHA256
84620e70a9982b643d447cce04d0044cd8ac39095c2de274c89c8c7686cec10b

SHA512
600bf18ad0f1b1633c2dbba0b3a5bc173e558c3458af0e35e4fd0427a42c0069f9e4096173996be55c03778926cf759403ba038f47fbe38f8ceff59e62c3568d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef6fdb1d587c7a44267286fe6c796599

SHA1
02b5809b4427713e53619e8abfa920041ddbecb8

SHA256
7da42839a499f865b99dcbb8795b03d929c77e1740bf397d017b83049c8f785a

SHA512
bf6d1e6e30abbf06e7d9b7a6a72ab516a629b28bbedf7dcb702cd67b23a159c1effa999a5df5af77f99c1f90390467bcc94ca82a29e96a463926e14235aaf7ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d31bd881a51517584133ac5c59e9e87

SHA1
0122598212724640cc42c98e85612922e2759b05

SHA256
af02dd0cf5caf3a6dc321e5841eb95a60b1fa11945a40a634b8d5df4116b2def

SHA512
03b7f933b990d58109e9885801add93896be2ac7541a186bd882b03cda553fe76bf392dc997398436eb809ac9260482061e66e38133cb15580a849747571c73c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1C49.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1CE9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit