058f5c1233c682ae62a05b67777cff98a2e8be20b66eeb01bb91f86583bd664b

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-09-2024 12:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d450e62740c7813988c512ccd7bc9509_JaffaCakes118.html
Size

28KB
MD5

d450e62740c7813988c512ccd7bc9509
SHA1

ca620cc41dd31ad36e414ce8c760284844f2c67a
SHA256

058f5c1233c682ae62a05b67777cff98a2e8be20b66eeb01bb91f86583bd664b
SHA512

5e49b2965e9c0332f2d8da611406cae715cec72197b7db0beaa5a21e36885e2ec2a2c2586cec734cb6f64fd58aa3fdbf1214aeef910e9e046bb1a3b8c6fdbee8
SSDEEP

192:uw78b5n5+X0nQjxn5Q/RnQie0NnCDnQOkEntHrnQTbnxnQ9eSwm6N9ayjbQl7MBw:NQ/0zHo3ayOSfAN

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00af473ee701db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{699383A1-6DDA-11EF-B2D5-C6DA928D33CD} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431958898"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c4000000000200000000001066000000010000200000003ae75a4061919d0e2815440efa74a8716fa85f8968f74c35c45de899a92d3b9a000000000e80000000020000200000009ee005bbcd376d24ccca159a49cbb001d9ceda81a98591e5bd2cd2e745642261200000004c03312862a5065a431bb1d7ca3224063b560099e07f4aa3f7d72b4715df69bd40000000ec288eff9c869044d76c3fa69cc7767df2227c20742c3ffb7f6b322feae394c0d16eff2b89a17db960036b9755ba9bfa63d34546dedeb00997a6a681f207bfc9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000cae7af5a33d43b72217d51ddc4e132e0eb6a1fa9b45da0f59842af0d50fbaed2000000000e80000000020000200000001a0a1526a1eedb41d565579605544512883eed7b192f886b2398edbb1819593d9000000020bd1fd4303b5ada529656cdfa7676867f7ea65b10e14c456c524f9fdbca51df335c12371ea59ce6d85014bdc806f0fad32a5ad33e005e9f659e1f55615d18b73d464cb45a4c6319fa96e49ccfa74d7c55b99b0abe738f31d1320bdcfa0c0458a61d49c4daee11bc841eea89a488fa4ee09236c7ffb887267f92e6ab724361defe7d454016452b27a7d0c1c753c68ae740000000b84ccbfdbb993bd957974cd0a4fc4d0206904160a64d60fd1549327dbbd5f9c95996de919a92385600a1f475264269b3dbecb9e7900cef39250cfd5255927402	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2936	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2400	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2400	iexplore.exe
2400	iexplore.exe
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2936	2400	iexplore.exe	30
PID 2400 wrote to memory of 2936	2400	iexplore.exe	30
PID 2400 wrote to memory of 2936	2400	iexplore.exe	30
PID 2400 wrote to memory of 2936	2400	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d450e62740c7813988c512ccd7bc9509_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2400 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83cf5f557321fe9314e91f6883f2ca03

SHA1
ba337f525e55b35641b277059b89ec3b35e63b0e

SHA256
8e044f6cd81ab2185510ea3af40b8d8ee3fbe9da0a2a170cc94c994397deb5c2

SHA512
050e41895901fc5998eeed6fea5d8b6311a859f51cd578fa5cb1655d567e127f6df3119997fec3ad03458a123603c6e47a6a81809f833d7dce3d38e774cd00fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44ea3952e97c3b3e7463157552f88343

SHA1
6e5dbcdc2480cea4ffa072944220a0278fc5b733

SHA256
d9480bb90f23c0ef31af15e3af86d029475d4920e58b145f009ae1073881a1c1

SHA512
144e3390b1b9792814b9ffa34117d2d37966fa9f3eaad500a240f5e551ec44ad8496501dc11909f45c3e375c3d62f21bfaee479069ddd15edb2f396857623a76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
506ec2b42747e20ce67e9ad191195341

SHA1
eef9d606ffdb0b21458a68066b52809b5e414b64

SHA256
079f881fb10da7605276d1acbfba4c1c237cb6a8fcaf054c62097b3ae9fd8789

SHA512
85debe646d4dd69280f04c9d6617eed62f90d89cdcd272fd9c7beb6aebf084bff1548f626accb17f29fb04998cb6986c2a42a7953c122cd87f478c4eed9ed439

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c12c4476274947839d8aa33377ea883

SHA1
d08bcfe41017037728a29b9dbd0b45cd6547c155

SHA256
be8481f336f338fa8a3d98666a018a67e21f3b720a45f7056db1d13faf4d1413

SHA512
6ed482e1eea394fc66afbe86f8f364ce9df6befc00716581c3cc344b9809cf7a2c25cd74c0274c392499677162a9e6860f298d94bfda47caf5b45fda3d21288d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19150b32d912863f90ff2c8ba239b566

SHA1
d5b3ffb82b8ffc4ae866b4f1b23b75f5b92bdbba

SHA256
88c8d716fd50d6e2724391ab9c12543c3142e9551e6671e7c8b29ecb7dbd3f29

SHA512
f0ec9f0a33f23b934ec95389dd5fc0476e894dee6bdcccc6815c241ded22e8bd6bedc11900e674625c1aff40d8c3a2f0e1b8346a9b3cefa01ce4e0907d78b5aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bf8f0ef13f5dfb4891893376f616e616

SHA1
840915f27e18034966bc4eb3257e31cdb42d75ac

SHA256
5d29207537544d0db2dedb9dfd418f5d90230fc365e298d17b24e9bdff9f90a7

SHA512
e55d62be525c78511be298c1734780f1b58d7d9f716edd618b90f86f2ce2f6e100dbd03ba193a1c6ca6721d6cd638e4af09ee48c1555a09f13f653b720f31035

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
234575801446cd54e4ff9b304c4df356

SHA1
9fb78d36a81ceb678cf9940b0c45a4e6e290fc7a

SHA256
e1fda16b6b0b4e84a6cbf3b06d22719c5709cb6c7dc50894025e40ebb0f9749c

SHA512
dd0b3e62d28183d6e53b8a57b52556df4c0621e56e6c93a6adfc79722ca832fbfe89961fbdb97e8f0ecb7cb9541b77efbf98415fff08f5dbca038142efe1e2bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce28c50e24fc085d8395479a41318076

SHA1
5a2720372e1fd9909217333554004f9b1e94da6e

SHA256
63a9c0b521ae5ae407cc16608934539665e1417a21efc1f5c8280df06c23749c

SHA512
08abb326dc9ad75bc44a5acd1a2715b3ea47645b1970b3da47c4db476b6499281b36c3d99c96f6dbfac7b868b82afc835edf5f7b42333c561988b01f283c3195

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a4c4df30c419dcdaf8eaada845e0ca3

SHA1
2200adc1a8a89b57e7f8147174b2f80cc9b35c3d

SHA256
b95273ef7df7f0995fba8674aa17e32dfe455306e541d5d93b46aa4fa4621378

SHA512
5cb9227072a6f57e787bdd37f9bb8d58294bab9ad86e854e5753a53d6d936927b2961191881a90c93b6631a235b36c94a9779a35dc91549ec59edcb86f99375f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
efd1c54c0764770f129e499a52facdde

SHA1
f951eab703848aaf553a0fc846a9fcfbcbe7f545

SHA256
c27bf4a8cce17679aeccd33bf679066e8fed1c06b21b82404042d4fba97e64f9

SHA512
71a7f820e2a12668a41c49fb80ef00363f095268a6157ae5ea524773cf193d8dfac367cda3e1f9b0c3c653d4a411ad0d62f04e1308eec3451433bad4ee7ea3df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae804fbd2e9a92f04d275a2a91893025

SHA1
1a9bd7cc0674e68ef372a1b8d1565f098631a499

SHA256
a5427b61e86d6741a6a59d82fc535984b2afbee11b83cf1b56272d07890ec821

SHA512
6110b17bbe4cbe00d4d865bdf8eb62cadc7e5cbcb2f50fd8bdb8cd45cbdf86c7e5692b73341c1e32e987a4cb07b265817dd2531b12c7cd35a9564d4a2e009a74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
939f7bdbebda26b667cdc4a230be2352

SHA1
c8bd1fcefa01bfbe1450561f0a2d84b348c9ed39

SHA256
8b6c68457be70fcc7f4d6f1201de651ae2618249f05b948c441be7bf3ebb549a

SHA512
6c8008ebac54420924697069cd7cf76e7cb49866ca4305964623df2fcf3a3a57ef70c37ef5381dc42eefc12d1b4803d7ea69604c021964faa83b0a4854bc9e26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52197f072c77cac81f2847f5e8afbf63

SHA1
23811a15d1d00bd939bff0d88c29df0361b9beae

SHA256
a4dd9a73899ec015770164e719b8e17738be46df5b79c17eaf8f82039647ae5b

SHA512
ce0ba290e278490b156eab2fce09ab159753fa2d492c84a6e2fd68306600e16b93d4a97f3ca01acc46d29c8caaa9c7b648c67ece2e7000438833759231f4f64a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2C0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar342.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit