1484084efdb64330c7d06c11591d37447aee48a0ac8377123c39b590d2816036

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 22:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d529d3ab6d7ccab15cc3098143113bb1_JaffaCakes118.html
Size

4KB
MD5

d529d3ab6d7ccab15cc3098143113bb1
SHA1

9445331bd62f696a06530f8e4b92ae3ea53fddc1
SHA256

1484084efdb64330c7d06c11591d37447aee48a0ac8377123c39b590d2816036
SHA512

287e6371f143f7dcf581859ee6b3d0e7ccfaa36bce707c5838fae4e25f8b99d745cf4126c2bd2c2271c3374029dec78c528bb5d3e9a755ec0bfe84242d0ae8c4
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8odzDWAs1:Pk7yY1aEFHVKtF37sNjtXATIQFM93pDZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc50000000000200000000001066000000010000200000003540a79a99e79824aa35835865ab99dee5b5cbdddcfad785288bd9c316712c4f000000000e8000000002000020000000bcf1bce782ee309ab82cdb17036780ce9efd6005a71b26403ed7eef9779bd83e9000000028bd29da115ad3ff2ffc13a188248d7c7b68632d2d6e666d67f6a7d76bf8f2d3d188b3f5aa43833e159c57432019728b6ff1544fb85d0140664473e49fb926b611409e1febfdcd9053978f37f9ab4c2375c7e5f8fcf3304dd84296d9d6e0c67c2ad7d2973dc9084511d612331ba5f47c18e58d6cb4a374490f662e1c8937025a787a78c3853770c978e3db8854e3428040000000c469f0cc005053221062ab7381208e9520379ff91d0cf0e50cbc7e51322803c37913e88e214eefe88442b66815d7476f9665c0e478d3bca62eb39f4bd0ba5ddc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431994782"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000b32a6eab378940ccc1bd7363855b1d9e5458e393a915e2c182c4de5bd8615a26000000000e80000000020000200000009713e887ed7e4abb50d375e1071e50088b0977edfd605015bc8c34f200ccd62d200000005b84ca63ca625b4a356b8800b57262b48f14d430d510dee9a298f5f6294e28df400000002667018fc82a3d00efc2136e6d8a03c7d84cf40caeb88ac2a98eaf88648857ff0918e123bdf1b9a62f8e849a9d3e4ad5b3eaa8d4928477e76ea87ff69fa13d29	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d04ebdc83a02db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F44D21B1-6E2D-11EF-89F5-527E38F5B48B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2104	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2104	iexplore.exe
2104	iexplore.exe
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE
2980	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2980	2104	iexplore.exe	30
PID 2104 wrote to memory of 2980	2104	iexplore.exe	30
PID 2104 wrote to memory of 2980	2104	iexplore.exe	30
PID 2104 wrote to memory of 2980	2104	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d529d3ab6d7ccab15cc3098143113bb1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3dc9d9b7091d4b235c1cda3a795a35c

SHA1
bfac573929bf147322f65cce6b1c0fb40d9c5409

SHA256
9c36e590770fd55a914098f4ae55e194e13b96999bc670fad34bb62390600ea8

SHA512
ea553e4617d7bd1c11ef96fb8ac3ca3ed69915757dfaeef5bfb6c16d55c6b8cf50f274d1d7fed05a1766bad920d983781be6215405ec7927d60e7f73c643d8e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
48455785eae90b5d850c05386c27e5fa

SHA1
109ba47254ca979723dc1dbf7ffbf29820a73397

SHA256
f3903cc7ab919b6553997f3064aaf3bd6f7419ddceeb5fbaae5aebc03e92eafa

SHA512
19482eaf819d11b28776f3d98f211de2186e85b936a9f59b8071c104a0943aa57c10f402f27cf65984d0068c25004fb14a751898f2025ae6e5a96ab4a984140f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
560ee8eddced97e41f4309347fb4c6e8

SHA1
ff8121f0d148001282c7749f3040fd6f92645f36

SHA256
44e32c30bb04d616c47890a63339fa72e04f6b406ab21db4118c43740bd1d7cf

SHA512
562be6d05c86b01e49906ed323fc25231875547dd28ccdae6f90b0556f7640f4ee1ea2924876786b639efa9cecf47088c1d98b61e42e41696e1e4c293af2d88b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6455cd1c8fe014d7bc91047a344be98c

SHA1
b2ba9bb23e0576bd2d089ade1a8528f508712084

SHA256
dc9d133a07644f79705842fd53c0a61c33f2c8b03da4650ac5d670e9f5d5f99f

SHA512
5673f405b888b8ff1af75a5ccdeda6274182dd5a69c3f5cb623ef23f6555843ba90ce0658e5f3250e2e48e48fb1e5d711d10ca13ed77f4bc4894c032e64b40c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
561a800936069a0e347eba2bf7e1671f

SHA1
83eba5dfcd172188573b83d25ecdd05b01cc35a4

SHA256
574630326bb5930dec6443f88d933cf5d4acbe4e34a54ce60545c4a1fb7d83d2

SHA512
7537ce5f4a135f2a22ad1d71794c4109f680b3de6eadd333ab987d9c1a072777842a4c9e13b98d03bc5163ef08410a28dd29f78e8f680008b775430162f8b484

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3985a200d5324a131870b88b2c5125c3

SHA1
174f6f928579b16137cf6532ebb36fd4c6ab4c8a

SHA256
bf141e1671fb2e8fcc80019728beba9f572120a09f153145fbeab06f774d69ea

SHA512
14c0a828edac931d4224826fe6fdc2e25943eb88266f94b0d6ed18ed58bf9a0a3367f9dd2e580fdd4f3a75f6a19d6b845b57a5b4bf080cbc6112b8dc93c05457

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a2eeb1c15cb1453900f9a2ae731d467

SHA1
88524e8a20b046b242d4ca3565d6a0c8e61ed06d

SHA256
5e928b8e991b72a7af42d165a69c73f70a24c1b0b26b74dd3ec831d59b1751ce

SHA512
f37a5bb3b7a46c36945ed6431ce3b1b4ecccb13c6db194ce4f2c5c9733ccb17ea1784751ff6ecf9d1eb4ec693598a8f59eb171c5205221db5a4bd3ddb673a8a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f522d5e71799bdbe40b80e77e8758679

SHA1
8256359c6563089bba41de81a195a2cfef8c4e39

SHA256
ae18378f922e8208027cc1cdee660a2924facba54c0da15140d2c7285e2dae50

SHA512
5fe4e157ae7285da7973e7f30126d84d021521c3ec56f336ee41c9702ad066a1ff4865fd76dc620ebae81c0125713194a8e79c41b2fc1c277dea6155d74e8ee2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0847f372a042dca7a640b20ed4b0411f

SHA1
7782c7db5c0cc857b4372420ccd2373fc408a556

SHA256
00292d44f403b1fe22833c31a0c27a503710f88acc99d0d8d40f11c09cbdf8f3

SHA512
d530643765e5ce9b664caf9ea5adf0c5a5c64da5f98968f6009a5caa24a60a089a9bf3da9547efa74a15e0312ded55fe1c25c0f736de488f7f56d742333f8de8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd957a1edce5cd23f702d80cd4ff4161

SHA1
443ccd35d3b801bbdc15321295e54040c240b5f2

SHA256
065a0bfe43d1ac95ff86740b3f8b10abdf69d77a0aacfa1d3d6eb3f83248c6d7

SHA512
823d8359a64602f485a34df71ab6f3b225ab1acb76475cabe0a9bf4d188eb54df4fd235ed5e55d72d1974c36355aaa7e0cd6964d6eb2b2e10de00a63428777e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fff25f4b719de0d3e7119a805275415f

SHA1
598395306dd1d11acde166eaa7f7b8997120b098

SHA256
9ac2bd0b60889de50852a6f97ea7bd54dba7dc761c6222232c080cd1b52e8a22

SHA512
815285a7f3d1a9871885d2811b0ec8769716cbbfb7341592984203bcaa04e5ea73e9b24c4a9c92de95244bfee1e52acabe49aff6fa5ce806a70912ba646529eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b855505f6faa0898cfc80993296009a

SHA1
afedf7215676cd6b426c8626ba259b479daf5f28

SHA256
aa27fd29a9c2d0e261424f851b64d8d26f8a1aa315f7cd7652093c4dcf65e407

SHA512
4b7029659a244e8893bbdf4713c4192cad0cffec9ed4554bb2de0a481d30d4c69437602e6aab2cc34a0b411240045f4e212e7673075db383e3b57a861e3e629a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6fa350019fdfb6aa426a63bd18d1170

SHA1
369169390f131bdcb72a98da1506ce71b1176242

SHA256
71c4d15da74e306c4193de19058005279c47640cb8fc176588c525864ffbb184

SHA512
3b2e699cd990816b6e1dc35cac67fa4827588762201e610e3b179b8795db0f391abea6cb2d08405e21db77c2dc94633f2ef9276339937b965c22617ae2ac6529

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9d0cd99d35687214087e93d852c5c4f

SHA1
4f3d3911ace5ea1aaec35a6cfca058efe6335045

SHA256
0de9043308d780cd5b3fa532740939c4013417ce4a0c01755d82a6e802d38d66

SHA512
55746184158c114b2b72a9fa2c3f8dbb9584b9e77c9b76772a49fcb87a3f4c9a3b5e2d06cc97160a9adffd505f6c55b913eed7e72acae3a375d62b2bf07cd97a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43bc12aa7fc7d26f102d3182171f094b

SHA1
2c8cc9f07ee4a597ccce03eda917b8ebc2c19670

SHA256
7524e4a99b2ff58d00629bc1792d117bf6fdc49bedb1e743e1eef96dc754cec5

SHA512
f8d771e118fadf13fc65573219e8f3c3dec8a7eb064bfa49564d2a67ee037363f5fcace5407dcbb9e46782b35fcc0af12724dfb7b4a30434c3a9a41493a00db0

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF0F6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF406.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit