97f33e5eec854958bb301591beb0b3508cc0be6c59b170d4c2ef7c8e164f3b57

Analysis

max time kernel
81s
max time network
135s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08-09-2024 14:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d495163bf4b804b76118fde59c473b55_JaffaCakes118.html
Size

460KB
MD5

d495163bf4b804b76118fde59c473b55
SHA1

0fac14e3ead05900b4757f826fc9d8fc2163877f
SHA256

97f33e5eec854958bb301591beb0b3508cc0be6c59b170d4c2ef7c8e164f3b57
SHA512

f1f83a06105f42fd51bfe7dbe7f06a1b3417fcbb3947d176038ad0cd0fba207351ced3cf7bad3332522c3f527ee71f401bebf41c46ef7484a4d8310971262b25
SSDEEP

6144:SIsMYod+X3oI+YnsMYod+X3oI+YusMYod+X3oI+YLsMYod+X3oI+YQ:Z5d+X3B5d+X3e5d+X315d+X3+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000b78c55c35ade755235ac49b4908273e7323abe5c0df18ce83a9de0d5cf9f3170000000000e8000000002000020000000f4498dbbaa40b568b29eb016c13ef1cc7742401abbb29dd12a397ced7bf938b490000000cab5d56cd27ecc26da2c1423a2e03aca4bf6508038868fa3fa4aa3483d4a3f49a57ceef424b00221ed0f347ddfbd1694fb519e8a4875c0c8b98eac0e62867bfc5c07d0f2485e8058962190e28a638ce1a94defb5a50bc471fedf55491ce501f712ac17fc5e963a0a5a59364f1a17fc4e4439dcb0925649c120c9281fe7faac71de9844e95969e77306cf23a5ba23b1a640000000da1ff3a5cd63839ec3db26b8eee82f2dbc87158b0ce169270f8b825f426e7279bcfc1349af4a8eb84b52d995b4ab1b99f6d517d74262fa093663ac47455d0b87	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E2FEDEA1-6DEF-11EF-B6CD-7E918DD97D05} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b0000000002000000000010660000000100002000000098c0001a41b3146ff095d2dc6f95226c6d79c2b093bf25a5c63928c1cf742f09000000000e800000000200002000000055b041ed28152828f9007c3dec598dde67795c5a798b6f8b61bf78b7ce5af2e020000000f5450abba751d1d8df6c3f0cc115a3d0d91e0b89001ca18c688525881d5afea640000000fa6809b9fe5c58cfb0d53ec81cbc1b23d79b4d122999c4a72e12aec18340e06abce36d62bb84a52f9c3bac44f52743581adc12344c5941993f04db105e7b4b3b	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431968125"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 301ceabbfc01db01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2208	iexplore.exe
2208	iexplore.exe
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE
2808	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2808	2208	iexplore.exe	30
PID 2208 wrote to memory of 2808	2208	iexplore.exe	30
PID 2208 wrote to memory of 2808	2208	iexplore.exe	30
PID 2208 wrote to memory of 2808	2208	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d495163bf4b804b76118fde59c473b55_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ee7c497896f0c734ca510b66e25af60

SHA1
b3c1a799c66e39ffbfa19d47c5869e8399b3780f

SHA256
add6204d1d0f37c4fbb43b02d5e76be503575056b0dd4efeff9ad37259dbd841

SHA512
a357f60204806390cc7059142e19ba1201161153b8e6d332b14d50c5ff419604cc71eaefb22e085ad2b0445f13452d47cc54cf5c815170defd87377de347d338

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93da0460d9484fe3586f5f1a0293a959

SHA1
b8af141b60b2fe74a38233ccdc8181c8db8383ed

SHA256
60e116163e630dd4971c12d61c3a53fc5c1db5e6bc67abff0fbb16e8f9614eca

SHA512
81927bf3d0ebe457acb08f819a1425984e3704880edd8d5499dbbb840dbc5ec3c645ccdc1a107d245d4d7d6dbe7b4bd7b8b9084cb9f97c01deaf8bf5f3bccf44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
adfb80c09cfe1f478940df3c2a8c4764

SHA1
0705ea2f7a064a8fd0063c2e9dbb662feea4d460

SHA256
df82e5a9d277ccea5713f9d2f49483de5bab4b018ddd4b1f1d6618f81dae59ec

SHA512
c4eda8a25e17857345fb9fe4a367ac20b716a701a2235a17f83f6f6a5cd0d9218a7b579fe2d005013cb6c580f6777abd3bfb3b324468c02cc9f215f0bb83e287

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6f7466260de29b544c290d11ef4dbbe

SHA1
b295f61202f612dbbd82607ad992732fa335f65f

SHA256
1efe70ad98745d9b96bd4ca8450914c4ec7bc5e3bf7920f867182540722e3259

SHA512
c220ad89c7c97e7ee57f89619c1524509f9acf1f69c5b8705033b74b4258b0c6a4d1f529763aba071492c6b247cef912ebf64e0fb95b2193b6fab5eb568ec960

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f2d31cc57f06e87ee29df2802e9fa29

SHA1
84593ea247a758714ffae22141c99f11b74c5098

SHA256
3eb4503554ee982ae092925bca6f62e0c44a515a95dc826eb3ff2183d27f4bfe

SHA512
d90a1506337070f5a4e2b997c0f00beef3ad2fe2a3c21716b965a1ee0fa71cdc2c501b40a7aca03d014ad9f606e07cfb9923bb8a6119e61c546c022cdabf50f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac3f7990ab8b10a9af0463a03b75f206

SHA1
6c6f2934e48170d247c78c9d0d43973edfa6c110

SHA256
e70e24c0c1cea07309c71f9af6a6a0de142141e9b446748f2681d65a95a48917

SHA512
3d28356b6441c633cd6805978d30288ef66a97019e12c91b206b15660206c6ae95592d55e61c002a2ff2ef8e8075d16a939e8112b192c51a47703a76c4b7e2de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24fda80abe1617b982993cbb4a1e63a7

SHA1
4a9a25773bef221cf974c86feac0f83104210126

SHA256
9ca8a96ccbcda23e01ececc5bba105e5cf5e8198d24f2379b816d29bcf151744

SHA512
f2b4c04d8e807effc6a4dea67beaf91cb87f42df009fa301930cd40e2d9bfc2907573be74e38410a89ee02a81377940021fefcb35b0b8ce7c8ed6a98302b33dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7827b97dc248e1c34565f7f2ad732ad1

SHA1
97e4537284d1ce8515952b98ffa74493e4bf98d9

SHA256
d09f34a61e21f60122f0542d5a90705c9645ca479a29c4a9806723537d171cff

SHA512
1d1eaec3d271f9781a40da2f72da2480fcdf1ce981c372fc874ed174d9d79ff603058af177244e8cf53b37b8db5d322fa2944caa1c10b1c1d5e58cbaea131c22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
229379f78469a1cd913859fda9de87cd

SHA1
ebf9b7c87b617bf3ac4db709b17dacf39ed0cf52

SHA256
79a8d200ebfd5c0ef3039c07c47212a6b4a3dce6ab098232ff4094ab4f196b7b

SHA512
8037a9410b18072871f14f9bb80394e2aa4ccbfa799f673e5c9f0708521429ab393ca5a9d02264543effc2e65fe01ecfa3e55ea02d8ec3ebe56aaff2e665fbd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f609da6d00358691172bdbfd94dc607

SHA1
56a8d348cf5dbae50a052b224a3bd5bd6f46725a

SHA256
ed759766e6b900d07fd0bcea7891781099fa6f7c886db0050e86ef2688203da3

SHA512
9eb77f3ba347c85b485873e4acf9d6e553b11006bb369a9861bbed887828b6fb1779f72dc10892f25af80d806dfd2f6ac010334f2f8319de75eae8bfc45aa68b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1f8c8d9e7892dcdc9565961b2126d85

SHA1
da3c8cd180dd387e209c11b19efc9cb86be93186

SHA256
69b8f0259b7d000bfdc728b7e868e64f022f69060abad3a2d1103dbd8e80b9ec

SHA512
e3cf41ba5bcaba2a8372311e8d30d4556c09ddaf0b416541a65c6a8e2d7e0e4ff427ff15a4931fca5761917a998f231a934a288a275730135faa0c6ca4eef920

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c05ff8971db5dc3afdbb22b97b11cf99

SHA1
736c417e5cd5612a4639c03a97f2ea400e313d04

SHA256
9f1a619e098dc43fddec6cea31d0eb949476294143260bfa465ea465262d0ada

SHA512
13b8e556e84aac99ebad693826f0701ff43ca1047f86ad65ee1b1c0097aa69048b9f7e2e94749c4fc6c8076b06f99dd3dddec05539ff1eaa0cfa636c9baf6a8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9561fe283d72867e9e2dbdeef9e6c997

SHA1
e1b450300c3b61d218c5c02c017132f70d57525c

SHA256
00eb748be14e31d7c1d30a58b281a3debe3d0ef12a9e31d0ba47b5a33d2f3711

SHA512
07788bdc157bdddbef5fd9b65e4f44ae9128f5a1f6c5c5fe722e78681b76506f38ad60471462c6ef5ec7625926786497aae0abc58a5f326d42e37e46df4fcbca

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA038.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA125.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit