824b98b20e02f05b8e651b449195bdc14fba7ded0af1b52336e5fd70bdf0e3f0

Analysis

max time kernel
118s
max time network
155s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 14:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da96ef46f71ff29cef4420a8550cc203_JaffaCakes118.html
Size

34KB
MD5

da96ef46f71ff29cef4420a8550cc203
SHA1

4e31983e359a31575931b6c73bd450af5d7f15b0
SHA256

824b98b20e02f05b8e651b449195bdc14fba7ded0af1b52336e5fd70bdf0e3f0
SHA512

6d91fa32ca657c0edd7541ff3515a2d7d3b6e39cf334d36297c7c02c4bb7378441c52704a16d8504395203f6a75fe83cb52dafc3679b4c101fa0278ef0798411
SSDEEP

192:uwHDb5nd2nQjxn5Q/8nQieHNnanQOkEntU6nQTbnpnQOgBcwqYEcwqYYcwqYQb8u:TQ/TpcK5b8d3+kXFJX5Fg

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000351d3b4941d0bd4180921536c8323080f12f9cbf3d0eb3f4979d004cf9be2f63000000000e800000000200002000000057f62733ce87bf13bfe8f5a849abd09c0d67ce143ec19f298067b128d65a9a3c2000000067790cb0eadfc32fe99e8b2d41dca17c18522b8627e635cce23e0a77f465d98540000000706d5e2dc2195a1c2ce56d8f133ad7dcdaabbc5a52017aa64b98da8b2c760d3ca9b8b41435becf20792be9647b4a8c2ebab7b3ddbbf96fd9b15b2642ed5dee51	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b0000000002000000000010660000000100002000000046e5b35368ede35b9735d228513a44de417699949d1d350386d171c7f8c1c2e5000000000e8000000002000020000000b32206d309f882f19fdd4bfa6cfd7746abdc66c943e9265e9f91fbadb4701592900000008c160a5e44351a53458b1483cf597d8a9b6ba0390f31305c57e8f004fae541d534c3a1b6f3193fdd36af8fe64c98893c584a2fe723db1e9510e97900f478a8f1bb6e0fe96e8c9e19ddbd98cc83a20f288803a2f161e94a9225413fa24a84090916faef318fceca706341c5bc5175c3f4ed31b55a7736b6f12d8b87115a5b5fef07eba18aa95722f8b27ffbcb935c80b74000000040c543873a25e02cb1651de13390ef8a63687d6b33aad8928fd67cdec898f24c0c2df2f5b8f673b08a9394fe20f08bb2cb4181a67d61b6cbb4184c544085626b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432228422"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E55FE351-704D-11EF-AA6F-523A95B0E536} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 5029bbcb5a04db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1960	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1960	iexplore.exe
1960	iexplore.exe
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2856	1960	iexplore.exe	31
PID 1960 wrote to memory of 2856	1960	iexplore.exe	31
PID 1960 wrote to memory of 2856	1960	iexplore.exe	31
PID 1960 wrote to memory of 2856	1960	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\da96ef46f71ff29cef4420a8550cc203_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1960 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8adedd8111a529f6e133914b64c8667b

SHA1
e87441d1c4db9232aa3ebb25c43a6a6955d5a699

SHA256
0075afd662027033c83d13559ba6c2cb679a8a222bb263b6628573bb6cae6696

SHA512
2aed48faa059c88083a8954f0e150d9425aad38cbaa95d10d3348481d648acbf018d23e31c34691148a2eaef8b18a8de86af21f58a6a96817e391993f1741792

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e9fffd36e534be11a64bf372e7cd679

SHA1
91c9b6fe672a58449e3dcd039befcdf8ac06ab3d

SHA256
e805b19775543c4b4dde8ab645c05418f0ccc07f26881bd3c834bdd71ce796fe

SHA512
8f9b4bafb4bcc898adf84b9e452c68ec410ca46692c648a89e9ed2d93b660179bc57d10f94edee0bdf6d55be01c46cf4be25a17d9e5293fb4264ac4716502483

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
651de982983217c44203597ee6df5e3a

SHA1
cd56ac3dae9e1cb0d7add5301320b4e774a80aa9

SHA256
21e0a4e1a075abe85155351a92fb8fc16fdda9b370f19db16bfeb753c278a333

SHA512
a9ac3d5086a02803ef41c0facfd6dd62102642e947505e38394fddf9604192ec6de9c4246ae5fcb6048aebac14bad2cafd2b82fba8f1e2b148da573cd8bf4c04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a653319b2cb5f18d245db9c75332047

SHA1
25d4a31393990ce5f2cdc377a171edab0bfea2f5

SHA256
41d60f4d15dc35e53775f7030afa460a2a8acc6d59daadd7ca65633717315e53

SHA512
cabcd7a198668b8dd9147cca9efe3951d38a48a4c589742ddc3f65e43f5fe5650948089ea7d17f6b4252b08d1d66f3e4ae2731c51b810872b129d8836498d108

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7122c6ba2a101e0dd14b56cca651a3b7

SHA1
6f525cc0c264f9d522b8c7c132709e26840e8f82

SHA256
efa3730502944660ea6f43c913926ae55ad647b1a617fed5acbfc50c688b7b1b

SHA512
b12ff292c0cbc59f174fb4ed0f5a64b15e50aa6082afd737246f2e46a674f95435d594ce7ffbb0ed7d13304eaa401a9dd31e819b16d52b563c3f5d1b065f8ee9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00b15595c48f5f6905e86ff9e77f107c

SHA1
d1811f4aa8a4999ac913fd65da46d13613be2170

SHA256
90b7cb17943cc46be67861c0870b45864da8d47f646f58037fb76bd7e19ecfc1

SHA512
09c5533b85f87f9cd9f5075870829140601bd1ed4c735ea6892c823e105c5f98e03f25bc21d5fa5b08b96164ca11d693ee2907dd591d9755158a8498084090ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62c486ff5939d4cd8a44940f8d278af6

SHA1
596fd1e18c4ba4a29c493d09b0c51a43189c37f7

SHA256
e283ea7faaabe1d242edf1f69dab4a8cbdcd79099db61b12259857b083ebed6c

SHA512
7acd8ed658c1fe798bd25d6bf0044891e1999d4862b1e7745b72eaa9c0d66b522145c7e172a04fe3d575d2b974c3c76cf18816a1ae1a8bf7f0684dd1bda8ecf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ffde1368f780738f1bfbf812035a856

SHA1
67597e058c3c2dce0c51e86e011e9f65e26fc93f

SHA256
8ab238b710f82e9fb6d304051203458e72999ccdf3db0c70e8b881ab46eb1c57

SHA512
7434524b1637facc4819534b5c9156b0756518406d0f7f95eff46b71768a22ea24596fe5f0425911a22c8786eaefe9d81592d2945dcac1d94ee7ad67e59339d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7ed449de6bb3fc8eaaaf9dd36f5eb84

SHA1
e3fa612cbaf911c19e3f206bf92be026c2e5851b

SHA256
a39f1604b376d54aee470538f081156baefc9f92a183d0b93c6275712a5fe790

SHA512
7f0a7d60255fcbe2c99ca71df76a16907cc4815390163004ea86d7f88601e44d7384006b4fde4d097956e0327af0b5f4d077647ad031e9a48f5bb2d2e41cc79c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d15fc7897912db76d84f0b0ae44cec4a

SHA1
0889f1a83cd71036c9bab5e649932a763a278bc8

SHA256
530ff587f16614b534e1ab8ad3a87ffd2ac87191d605a22ad24d5110fe796bd4

SHA512
cb4cde7b882d03533f4cbb1f2964d080a6cacca3da59136ad35e37fd0e2f5e266de2cc11dad86b03f8f406053529f991d32bffed811757698c7d93f9c63e83eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b5eb9a5e2cb7ecacd903d35db25d4ac

SHA1
e9623d595ce2ef6759a6c0310bf74dd488ffe2ed

SHA256
0bd1342ec5d06da057df7146d4ecb3336ab7731751fe9eef346d055639927316

SHA512
457f285fea0d3960ff9097454dd5a7691df142bbe7c5fc4126895fb596b423fd32d200adb27a3d7d895429662cad7ad60c387c96e5b205478033766c926192f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31503c4e30c631e1236c8a0956ecf39c

SHA1
3b6cd1dccf6ef0430e0d5d1bfb05a38d3d9024a6

SHA256
a1b2a980483fd42093289da81b0e8087656da14c6e7a25cb6870ff5d7a9f5150

SHA512
cae7836cfc845c802b32b4be8d27dde901647271fad86898674d967514fc95bd596c2cf7193fd20ca605a392ee1d64e649b6d79a44138b497e7e367023eb4ec8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4dec5f6f1e4d227b746e81bcdac0b24c

SHA1
59147f9244e1670031a3e2a5cb1477f307396b3d

SHA256
ef355eace4047e14d64a71bd050c9c8832cf6c05df2ae55c824827de8b72a510

SHA512
ad645cbc0cc13a5034769143bfb4ea4ace443678626f5bf783098833084f13b6fc8011459922d2036d01e5559a2bb364bb266648b7c760c9218dd5c396590d56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
236d239e890f00bc2236af22bb90d307

SHA1
60fbc0887a4e0c4bfac6457fc384062e3f9de924

SHA256
9dfa54645300c92b2bdbe042249483eac095f4165cc1df5b12f8d852771a265a

SHA512
8d43918996fb41385e78c9c5ec66b8d8180693cd61500ccc97085ac1423b411be186e12c553532a5852a46bade90ed0d3a5d42f17004c4e1d73b0955a6ce85e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7679.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar796A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit