23e89858bf9cb9bef954e3008950ccdd084ce052f52d24c1ef58f67e5334a03d

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-09-2024 20:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db2b9e4faef3c8980051f1e0d98ade89_JaffaCakes118.html
Size

14KB
MD5

db2b9e4faef3c8980051f1e0d98ade89
SHA1

148eb3c267d82554003b76f25e490a6fd30c416d
SHA256

23e89858bf9cb9bef954e3008950ccdd084ce052f52d24c1ef58f67e5334a03d
SHA512

80e8c5924ec19c011ee6ab528dcc15241b1eacf960fff42ac602931f93b686fcb3ab61593311ce7c2810f51e27931023d8cef7518d6b0be4c69cbf41f6272d9e
SSDEEP

192:1Y3dwvKBFPQ6NDF5ByBUSPBKNZ5raO64ojT33vjS4sZOGCt:11Kf3SPBKNZ576v33vjS4N

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80a3e7248a04db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{505CE981-707D-11EF-B594-F245C6AC432F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432248768"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf60000000002000000000010660000000100002000000097714a67777650339b58bcb647b845c471f1fee1b13dbffb5599ae4f445a5f79000000000e80000000020000200000005e2812296032d29fbe825e55dfb2cc995a68c33ee448193d107b3a7bff09efdd2000000096595effccb270eea53145bae60242d3874ee82ec0c99926defeece99d8385c140000000bc08b1cce56727b223067fe6ef999d9361108c73043388020db17b31003095415ddcba7c0b75f389b561773c8ef7bb0dab51021404f45ba95a10ddbca8caa867	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf6000000000200000000001066000000010000200000003f3ecf1cf4ea56ccda9fdaeb1baf3ad0a344bd282bfbd596b4992f07b1d300c3000000000e8000000002000020000000a1afddc70eba9cd00212d291c984a3aaebbe35e05c953f7a0dfeb4d5755f13239000000004dc28a5415d335a0170a200f92778ea9a1b1d57ce5a792750b94793eaef57627d82b725578099b210fa584c794c3d4285cf94a320dce31e3405999a4b66734d867f0f3d4760a3a99bcd72be544ac453a04bed7fb32e25bfa9f56dcd4fd9e2a2929b830e2ff9469b9d5f725a953e81d91a4bd67f42004a4a59429c64afef5d6df6b76f5b75a1d0cf70746bf17744570440000000cde0cc22e534b4438aae316d0c1e457a75c60ce0670dc46d80e31a0ade63e1e123d04b7387554fd593c90de83f459969c1c18664e20ce2fc0e073ea159437bb4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1996	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1996	iexplore.exe
1996	iexplore.exe
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 2260	1996	iexplore.exe	28
PID 1996 wrote to memory of 2260	1996	iexplore.exe	28
PID 1996 wrote to memory of 2260	1996	iexplore.exe	28
PID 1996 wrote to memory of 2260	1996	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\db2b9e4faef3c8980051f1e0d98ade89_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1996 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e33d776c0de72d7aeb7dcf583602d53e

SHA1
f3260fcbbcb3737d527c3390c9ac78f23693c63a

SHA256
f577f79010b4a27368d7432ebf7c2201b5724c20638bf9703f0cc7fa3c7db26b

SHA512
12a8699eaf0993f28185b15085a36b7312f4c67fba4592d6185a7bb96175d2eeff9cbd8def703a06fb498970e032c8484c81c7bef27229596820446ebd8bad4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ff0844fd2f89028e6c31d4055b15b9c

SHA1
4bd8dce95f14e3dd85fae43424a95e56927a25a7

SHA256
2be60f9f418361bc013a33ec536be631177f6dee94169cb4ec41208aebb8d559

SHA512
f4bcff70844d8522440dd03b9ade144ad4d74599056cb8846c530fe36bcd5f9120c98a0e017764a31fcde9c64eac1a19d939c3450c5cdc46e45f81f8cc7a80d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74b82e9e2773027ae46c0fa49b188ec7

SHA1
906e35eab10f321e401abc145c9f2e38d66e6330

SHA256
e80001e3b2aaf3c20f319a6621927f0e8ce958d6a28403a2b3eede98383f0373

SHA512
722a9ac08df00ff182a9c981e0b93ffa959b525b39acbab59a9cc9406810734b64364f9b7519e3ae238eb859a57784f97418a568894c43e44dd2eb5431ee089f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3514a8947be7b5da1a371e5517fecfb

SHA1
6217e0be60d6398fd053f6f08c18af4163d7a924

SHA256
308a6f8eadd25f5ab8ed107d1d758ef2c1f369512325b79238a5a4429f731e7c

SHA512
48fef1532ec0802acca0a219df78d3129637667579e78a6db58ca5efd90d265ee7a21458a7b4b0a007470585f81da5ccc3b7918d20f22cfb44a513c433f2439b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ddccab9614d87a326da7a2d6c1c72af

SHA1
fe64e433b82dbf6e6e8e0dbdfe536af183e16c3e

SHA256
aa5f499feb7c4f7f51a82aee2a0dcb56e31816cded07ab9258cee56e5d9efe4a

SHA512
afe74d483d58b856d394e5ab8a7380ee01f96c99f7f8f64b8e0c31a1b7a113b8182443096a2f33700bcfdeeee07de4269e7ee7f79e95b087aaf5b540fdf84844

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
48d3e4610d6361051a91b45259441a82

SHA1
f8832dc52fb2529b66077af9052e94b607b1485f

SHA256
e81551d246c678ceb1b2a5adb36fc0b3438617117e82d61868042ec8cb393595

SHA512
2dd415c9f1bd7c6a20e8f83b7ee09d336704b8124d8d8348386e012e71329bc6d30222540c5e04484f702cf73d4d88fbb3bff5d36eee43c63ae4bac2b8a8f1b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
078c329e3d60956609eb678127a364e1

SHA1
de6b749ed0aae4ae6a0e26376aca0cf4968ab1b2

SHA256
97c58ebcee34a01b52c84b2ce8f911cf909d0b99fc513619679c7def86e0e0d1

SHA512
739f6861aa8b3d940f6ea6327cdb475369534cbfc2549d157d10d567ebdcc32a7f6c5a4d4d18933e14371828b9996b61d9cd565599f61a9e2ea1b958b1df0d38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22fcda6e9c593b5cd746e93a9ac0b378

SHA1
cf11d77d8cf3121ec3eaf4e82b983beddcb98c3a

SHA256
66fa45258a4acdc93b2db9a26ef6d3706a2ec759987da1e3c5edca842bc69484

SHA512
6e9a413af3b0b9d30b4af7666cab5d9e2e2a49409e38859830c2fc0e9812a58ee3e3e1bc41a2af178cc300ef1002c5901c126f5da185a01855a9ec7ac8c818cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08f4dc0a180d761934e00d014934531a

SHA1
4fdfce55f2c8489785a240a727e3b2b9480e8036

SHA256
ba5f4ceb80a2f28873156e8cc101a79e48c23fb7023ab40960372d82d2481583

SHA512
121a7c2675aec53f0cb50bb860676a2ca598f27dbf68261f7337b4765e1e4e8e921f658743e573271da7d51d4b4024e936f0298af20756744afe4448c926e403

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3fd467fcfa0c462898ea68aa7d32f7f2

SHA1
cbb3b80fc6453170faaaf72732152803b6cb2de9

SHA256
5df9f7f16e11d1ac5200b8bbc7b9a85e4e1cd17138a486a3a064f015cbc0c0b1

SHA512
6baef0e08af1991eac7c4dd047e77a29b2c4f0683f6acfe82c41e9adbdca3357eeab50319188b14c84233e39abcc04be3bb3ea02d36310289bce66bde4a1878a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9c336ee496259c792f7aa0591a6c746

SHA1
c26e11201d481ab4d1f1c3b9221cb0d4e805ace4

SHA256
717e4673a6f141635ca894750ce27c549099866a664fe6745519d12bd0e786b0

SHA512
02ea75c02edb92143a67ae9334c7cb16b388cb33580d598843730bb47613c18f6cb04b6ba2c856e282e98dfc5fd8bc4245d0701a7c0eb31aac0d779b07ebb1ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee4cb0295650dc1641b1e0aa6b4fb5bd

SHA1
76887e0019c3d7dec80b41b9acda213afd92e429

SHA256
6e2460e2f28f726dbad5aefe7cb87b70b6e35057e6196976c24a375d1760b83a

SHA512
943c404a1f996f0a55cd19b98f3b2795de35fd0ba949a2e3f33632d8942fac14f7132bc2ca59667faa6d998f9e3bbfc8a8452fc3644623e5f5da3eaad7991847

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b3fb584839bdf71949abc8e352de219

SHA1
25e732c1348e27056ee301c6ee1a9f846ff1c97a

SHA256
d4c2fe59a3374ce2b38898bc546dff7a60c227d8d6c2128ee8074fb20ba2ff83

SHA512
875e452ddd2debfa065954a961bda8cfe7937f621f3669d5e356f70ef667677449d4e6a32f379b6f86c7d224db870f5a14fec8c48ec7c9d09e902a89e1ff09ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94a48e82913712ecf37926dc21f1c2f3

SHA1
56c9667f256c82092a5b5f06081823afdf3fcfe3

SHA256
62e7ec16b2c70cea3d7c19d9dd1578c9007eb3ea90d2ef7a99055806b9edd64c

SHA512
b412d541470e651c90af48da7bfdcd7fe1b8047aaa5147e7f1db09666f0e9daf8193e183fd7e2788e1286311f1d41535eba37bbe8da7172caf4c185a4c8d015a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e107d1494a6d28d24ac7b5f74f1df3e

SHA1
fdd7b1186b247b7d27ba647d755bd797473a52c1

SHA256
7f80e6c491cb2abf111a3419cadd04fcca89847a18e6ac04dd35cd7e63cd16f4

SHA512
9fc631223044f144f14d49bd55651960a7d97b472ac0709aae3f0b6de8545ca54651d4111ef623a7f3ac117249691e94b2c37d2e2e33f2b49d145f7ef5c7006f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab4beec12d5c9ad73aa7083efa60da3a

SHA1
847217bcd0b7cfb2b3471ef4c6c462330905a707

SHA256
a06c3fe379e0d0a542da036d3d1bf65eff2097463ed7e0d1fa4b60d45c140a5d

SHA512
9573d66167f3527faff7acd1ed594ce2f8df6d94df1fb5d5ae6577b7db798752efe9230db4750b9f8ed4feca49c22a64c033cf5a3f76a180e65d9b3f734ef2c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB607.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB679.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit