128a21f65f57edb38f9edf6baf900e60939e1fab24976cada8c080ca13793ca8

Analysis

max time kernel
118s
max time network
134s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 18:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

daf2337830330bc132affc7e2e82ae02_JaffaCakes118.html
Size

4KB
MD5

daf2337830330bc132affc7e2e82ae02
SHA1

d53fa14a3649a7b61e94fd588d1e0ec55c8a2a1e
SHA256

128a21f65f57edb38f9edf6baf900e60939e1fab24976cada8c080ca13793ca8
SHA512

89f9db682656fd4c11b55aba4b13df02cf646e019cedb1c6d4aff8352f0a7deeec856ea4be9bcc630e8f57c65475c5bdb279a711ef5bc56e1d6faa0d4c2ef656
SSDEEP

96:Pk7yJozTGknaEFHVKDZTBJl7sNjtXATIQFMA5e3fhrvDJUgwa71D5iJ8ondC+AmS:Pk7yY1aEFHVKtF37sNjtXATIQFM93pD3

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000be73ece73234fccc646e88b48d676571f93b745bc34dec64ad4587c7b38ff0ca000000000e8000000002000020000000dc7a71c37512f8035aa2c9b4ae17a089f0bf8dad53eaaa9410939a8ecdbe393220000000e32066a0137a8deca301fdd95de51733e3fb6fd2240caf3bcd25f3ace6fe7d6140000000a730da48822f13ad4bfa4e24a7f75bd132a76d31c3ed28a43b39c9b72eaeda07eaba8ecb39fb5b7971da0d0bbfbab548631698cd4f8d3e2eb3ae1bb675f98708	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A3C1C1E1-7069-11EF-9112-4E15D54E5731} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000d7125a215c3ac3ee9a5fb1243f50030abb4bdb2bf923d8b5471b258ce80192e3000000000e8000000002000020000000e20c8743334c53d39c8be444624eeb9bfd8cdc62afe6b8b0914e9d4fc59d645a900000001bd4349c5faca1de33830101f7794cebb02f0daec7adc013ca9b5b1168e4e13805c891059660a29b1dd8bc745e6f60baf37601298a3d66d1905a24c8b3e7667775f27bc7a68a8ad71cad55c39d73ca67b69f150aa37f90a65367f31a1ae062c5997170f81216348e824b25f4707339bf0e78a0f7d2942516f2cf0027d64ea223f0ea6072758b6327fa3fbd4d793c73fb40000000d653cc95e18ebb6622723b2506b81e5f5e310da6c6763ab089ab3da5f031cead866a2523b2d7f2b3d9f15612d2ee554495f0e5e5817dfdfe014e3767aa0bae9c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432240320"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 108b5d787604db01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2852	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2852	iexplore.exe
2852	iexplore.exe
2596	IEXPLORE.EXE
2596	IEXPLORE.EXE
2596	IEXPLORE.EXE
2596	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2596	2852	iexplore.exe	30
PID 2852 wrote to memory of 2596	2852	iexplore.exe	30
PID 2852 wrote to memory of 2596	2852	iexplore.exe	30
PID 2852 wrote to memory of 2596	2852	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\daf2337830330bc132affc7e2e82ae02_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2852 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60b6b55dbab1d0538e3fcf6f312ac02a

SHA1
bffb2bb63f49e7750ffc9406d801444c73ab7596

SHA256
b78d61de6652085febe7b20bd49211c0a4525cd9b04587a8ad69e58ffaae2c12

SHA512
2776f1a5a91f1898a6e737a690fbce0343e1e913e03a87bacca3e55fe5f3d0e6405354613623b14bac24479ab5f992771d24c85e94dd1076c865e0a2c4b07f25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3c1058e1033cf7d9d77d14b77b5f908

SHA1
2706da59ce2248d66f1850c37273dd57eaad9d7a

SHA256
49db64401b754dc7920da0c7eacca9db9ffc86e31b1917adfc444be71c13fd38

SHA512
e8536b64a7faa70671298a81006d12d2db6e639060926e21a9f2ce0d4e340122f41e28df58727ac6b8e4bc8f2e1c930534758766dd3d06aa1a6182c6f996a32b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cdb12302555926caba7432744423b46a

SHA1
37b110f0de37ee45cf462e47bf0e65df529ade99

SHA256
b077e74f36a96da7c797fe2436f57de8411881d0eacbb1a551c70ca8a970b145

SHA512
00c1d5da766a60a171aac870c788724d6544cc584575d097b57abdbdd72cbc5b965288ab00135c0b88a0119b2fb8c0f2db23a19bab464799e50f8b55bbdb9725

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6214e4ae3443b6f297e412e3a3bbfa79

SHA1
cc5c22eb40af3de6f2d33a8a7628d8a5b01849b7

SHA256
8585d922ff29ab8306e8eb2512288994be07bef453f3ef4e8c56eaf25ef9e75d

SHA512
d0b1d7b0891f9edfc070bb47889b66bf9f3ff3b019fc5bab86091626f5b644e84150a58afcf336ab5c14f521bfcb9c241bc13e77e0f200e4bccb926bca25fb9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea3fd9845a21ac7828734b1efde6c306

SHA1
7250368a92bd65dcf5d15141d6528e561286adc1

SHA256
92b4f202de1a05329738e097bf977d448e7187ab9ad9dc13436feb6778abf0b2

SHA512
39a5578a71f2818050264fa541e3b59aff1902c00639e13a854ba232201db6eb602be80fbfaa4c62647167e09d0ecf4163b18fb69cacfcfe44b68fa5f74f2693

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91841dd538f77e2cddba11d1820c5ac3

SHA1
f66536c8fb2847c16c26d16df15efa1390071f6d

SHA256
fec4e2a844d8f64eb64d06512dd9a174abe2280fb03efc0b0b306b5fbfbdf191

SHA512
bb5088c59c734585f919a0c2ce9eb24f5a89c8a8722a39181a76dadece0e67e4ebf2ec5f7e0fd3ae7333937d9fd07c94bd00787f5c97643da29dccc661da86cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96ebc62d8a80f2a4e8aff7c3dbfbfe3e

SHA1
7cf478682f44fde16ed09a7d1b554afe05185af8

SHA256
853989fac841fdfd39f963139b881e4bba5afc798f8348d6909ee61eab479da7

SHA512
d411e8d7beab4b144330c317f8d28f5248c7ff47b7a7f1c19398572ad06433349567cd0f775641033bad8e66f360d79ef90b9ee59646bb9d235b65232ffa915e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b2f524aa9070a3770ea502b0756c723

SHA1
d95a7450d2a8a7530174d6b07238cbc0c1c9340a

SHA256
655b7d9e2217f7190368bc07d59375558abfc343c06432c80e8ef028985e6269

SHA512
cd7bf8537a251b926dd98bead345ae682c317dad0c672b56303859c530e2d31b89069613a49e89fe446219ef2dc0e877f27e9a2ef085de6118baf295c481ca4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a56b8af7b69e24c928a0fecb1b78c500

SHA1
ec958d7f862f016f7cba3c779c46c5c1e0d7b811

SHA256
5daf3182750daf7000f20a4c655b4cbab6271e188a63735cf8e705e6d475e34d

SHA512
69cf044458df7e7699e48569628ff78cc057c79fc1187f419c67cb3b21079bebbb5b162c3814cd9fe1e7bb6b7b0121e1efae083577c925971faa8bfce9c379ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
acb3a39f7f08cd5f07aba82b8ce03d4b

SHA1
369ee08c12b69803424b36527165275574ab1c1e

SHA256
672c8e6328d474eaafcf3ea72e13e6045ccdbc9fa45e214840508b699ab82782

SHA512
4f60de5314d707d2f78a64593dc16f15a6c2f0d1708bca343ea7adc441eb300a4ed60ebc12c2c75c46945cc8c93b0500585cd127c156e1b489ffd7d7f1f1d3fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab932E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9727.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit