b08bfa2a2c8cdf24982c2981db0adc7675df8786b1b30361e36d8f6f7864cec3

Analysis

max time kernel
140s
max time network
141s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 14:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d682d695487de126481f8a21482389ee_JaffaCakes118.html
Size

140KB
MD5

d682d695487de126481f8a21482389ee
SHA1

45f551daa06a169137fec025eda00541cf806c95
SHA256

b08bfa2a2c8cdf24982c2981db0adc7675df8786b1b30361e36d8f6f7864cec3
SHA512

13e85d01e22fbc7d63cd3acc4dc8740c0c2f6d0645163ef5cdaec17f54fee6fd0b5b43313095b530a5e86d72569c44a292728a9e0e6091e496a1dc0a06c5adb4
SSDEEP

1536:S4lt9DrBFF38xlpy/yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3p:S4lLvtyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000004551146c0512a5c3cc86c5d07b5ff5cf50809ee4fb706d929d8698e5acf1a6e3000000000e80000000020000200000005055b82793e2d3d2ba9092c98f2b9d8389076e1d1329ffacd1bd2d7613677a409000000044bb89cde385b9829ad0033ad9de1703edf549cf39ac0e679a5363bb3c3100fff766e3bbcf846c044d8ece77e38f5a88f8d25369bcae7489dbf2f13489d4db85c7e83018cb339948b6d4f1e3f5c1399d25e061820f4ccc0106ca2957e12b1a6243d3eb20d443b04ebbe1e0d79d8c9b7ffdc960905c4e9b2b93a079d66a6e7368608450ee422f467e79ba5b8dd05661b5400000007818b598189c9b9d9d3df73783cf5cd2203aa4807435b497a5c81b6feaea75d1b13332c2d5b6d8ecd347e980abaa71df13170c713218d87d6ed43c6642a727af	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432054212"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000007a7c450c0aadc7144207ecbf88d61416841c9783d245c33eea97e5ff5f09d9d5000000000e8000000002000020000000109ef122a9495af208a96eb989595dc8b46e1c902127dd21348f1b789713a617200000003c7481255a72957bcd10355f3766093f981c40dab151194378b0bbe02401744a40000000d8d5f15c77d84d1ca6261f66b28beb77055cfcd7846c5f9a73c79911a7e56cea188aa36436a4e0e838ebee6f58e194f64647e4764c711baac9d0f6e15d9146d6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5193F6C1-6EB8-11EF-91DA-667598992E52} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e006e566c502db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1296	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1296	iexplore.exe
1296	iexplore.exe
1928	IEXPLORE.EXE
1928	IEXPLORE.EXE
1928	IEXPLORE.EXE
1928	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 1928	1296	iexplore.exe	30
PID 1296 wrote to memory of 1928	1296	iexplore.exe	30
PID 1296 wrote to memory of 1928	1296	iexplore.exe	30
PID 1296 wrote to memory of 1928	1296	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d682d695487de126481f8a21482389ee_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1296 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
87234253ac63498b86f9f9b8f9594770

SHA1
552191f9810b65f0bcc56bea1302e875f329b721

SHA256
1e81a5c803f3d8f9ec8701bc20f910c924f66cd63fc32ca52460638f724a985a

SHA512
1faf821fcc08b314c0e8b9b11a77e96eaffe981e91b8acccac402e0f39c50557d2c1b6d6249ed4e4dc2e0f76c1fcc177da67a7da17bc79c59d342178c3249161

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d23096334044c33084da5e7d6df12dd4

SHA1
b65040c46f5e207152dcb42717d4ad72b4520b75

SHA256
cbd5c44b69e8040852bd33112f3eefd0cab2b19d470c7274be763fc854ed42ab

SHA512
b0ad0ae84ffc4e23cd99e746805aa8bef617b5a4b32b6a2077eed16869a92fcbc80d884404648dae33c506dbc2ee3f69dd2a3d436ac53343223e9c284241a3c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b672da770f72794cfe59cd5032bf14db

SHA1
f691127fa75c138555951be84cb00fae5a09d426

SHA256
c5299b41e0ac3b79a6eaba00c349068535b4eb0969cf51b4e90b112a49094a40

SHA512
5195e529d0dd8c2fe4675ecbc2183dd2ed31d7b0cd71d1d82e368c707c08dfb20b5abb5af3e05a4c75b235aecee0cbea18af112d1ea3917861b906f65b3c4815

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60fe69c624b0c36979e85931fb52e8ae

SHA1
097614b70b05e07180e8b19f726e895348f681fe

SHA256
a4775a42bfb98213d58c58cc0ba154362edf8d450c3364ac547a5680be00aed4

SHA512
2d6d688c37fad3b61005c8d2545a9a48e5031a6e24cf1d90fbc98fbaac024dd2ed18cf19ee95896f4fd21b447d9e89b86f46897d5989a7c14b21fcfaa1b2ef94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ecdf7e77dbab5ed1cb367b826b18dbb

SHA1
f7407f52d0f2f76053bb3e7f508cae3e3db3381d

SHA256
de3fc4bec816c80633bb6767c5df6d307e99ce87d9afd8797ab9170d23974dc8

SHA512
35403d6c5b37d9a4a00c4a4706814c9f3e18ba52f0c5ae07fe02bdf2a3a2b0d51e3ce5b8e4be2ea0661d8049c6b9a662cdea35adba1bbdffd0e61403f4587620

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28cee4367199a75803533f6fb5b5ecbd

SHA1
66c96c11a45ef6da726a82db978b40d5b3b25626

SHA256
d0ddc937d8fbcc13d7ec8ebc6f228d2937dc7b0fd733d41c9fac9edd01025823

SHA512
69c0f7e63ec0881f2244c23bf98819efa75da4693d7092f60bc09ce9f29120d229aace6760248256b38d1b00cdc0e1572c69a677f62bb26da3139e7023c06415

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2bc0b90dfe17eb76cc545abcca88ab6

SHA1
7da6aa877cfb1b6712ab086a28dd4677fb2f57d9

SHA256
d8384381b1daf84ba05d1231bfa218970fc51a587f099ee3b147e5bf4ac31d46

SHA512
633e8adc0953219c2d548a825bdaa020a4766e950df0e03ed3c9c70c0a70e937a1d617466d6a2720148bdd312d057a03a15cb4b85a6cdb24b05c218f54f3bf10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
520c8d9eff03a03b1bafec6830ad763c

SHA1
9f6cc56171fcf73203b214ccbfd110b3d130df6a

SHA256
58d6a5d0aaac9287c5d020e67d9e1d805e1dafe463bda1cf7fe144b819078494

SHA512
9b7d6af1b73d5abfaf643da2e09313f00bdc993db24dd18a5a5980093af4bb0c247dc2f344d1a902142241f999f1a21838157b8452835b7b9c339ca953a7c458

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f73d1ef8e84bea614d90b16b3de0d010

SHA1
e8b08898f4ac32ae8526fe8e018cedb49d9f1989

SHA256
406033238bd33a796d031d163997329afc770c535f421a6ad5c121f564c1cbcc

SHA512
b86ad8cedc068f6b880bacc7b81bb88f7b5662e6ed85db55932e51c60159a85b67dd064fafbd19df721c83dc74edd01796f4acfb2998889163dbb59d47a545dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c326515160855df94f2e7a9011fbdff

SHA1
a673ad096a29dfb5e9b6a92af7e9a9c357743685

SHA256
06737520eed35fe65e61303e13032283f3d9b5bae7e34d6af2274a6041dd7ebe

SHA512
05609a75c59e9156c3b7d3c8279caf66748fd36611b6d49c68e83f03b89fe27a773b0b8edffc85387ff925d022ab62dcc95f3a4a87af5d3c0308e4028f1e4d52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b235ad2438ac1e7f7d2a8a1bc4c7bce

SHA1
8e5caabdee6da6215429a8016e80595255abf84f

SHA256
71724b26231565f530a7edc12d98d320f31be8247aa07968e64d45dd999d169d

SHA512
c1f882711afe03f0c3cf7aafd228dcfdd74bb1d47e980599ac9df4fa91d3c223797e78daefa0edd40d926fe465c8ca263597223b2bfb7c28e48cf394b7804bce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9bb1f768ec116c0dfa0631e4f37ee1b2

SHA1
55d119038968029786429c5d2237f87051c04a2a

SHA256
19e8d80c6193dabb1c1a7d2475784da72e53854478b8f8f5fdc1e5a2e6e83131

SHA512
0d4a8f865fa34d3aafe07eeaaa2c1925807bfd74604a00569928b94fcf6413f161722af40a3bdacdacd5a4f1a3c4376d673e2943bbdfbe76e32c2ed8d3835a43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OX8Z8GR5\ads[1].htm

Filesize
114B

MD5
e89f75f918dbdcee28604d4e09dd71d7

SHA1
f9d9055e9878723a12063b47d4a1a5f58c3eb1e9

SHA256
6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023

SHA512
8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA343.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA672.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit