6519e900c881c936ea7d648929094d533740b36eab7e1cccd3e7878b46c91f32

Analysis

max time kernel
120s
max time network
133s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 16:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dca4ccf5d01396cbdd346f164b3fdc37_JaffaCakes118.html
Size

4KB
MD5

dca4ccf5d01396cbdd346f164b3fdc37
SHA1

989407e1f344299e3a7c42c9a9bf99207203b10f
SHA256

6519e900c881c936ea7d648929094d533740b36eab7e1cccd3e7878b46c91f32
SHA512

3c766dc8a3af09955b40bc73c320abd5f5a27926825ea7abfe7c77967d889010a89db847664680b0f1bb1e90e16acda76ea32d2a75c2d0e3669935a7e28c7cdc
SSDEEP

96:1RAd9hwVPcoGg/j5yntxI8vq/5K/u04Xbwu4Qpy/:TAdbwWo1/j5sxI8vE4/uPrwuj4

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000673ba8e346b3cbfa585fa485e66d573ff50425bf61fe46f7dcf38473d7fa8469000000000e80000000020000200000001032b0d3dbdeb8d67f55fba9a5029146adde162aeb4a14bd51b966f4844cdda8200000009e0548a4500fd0c800eed458bb57ce42061b6fded64a118e8fe4e58946d34d3740000000e026ca013e8e3953bd987b381fdb173b69105f442c2807eefb7180dc7536c1822d771aaa1e94e315772dbe33a36a9ce2ae6463f1b78578441177ead5787602ff	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000008c42ef15f8cfa2b2add122a4bad63d40cab4d013de69fbb99b009773522c710f000000000e8000000002000020000000ab338c4dddd21dd8e0b96ec340af07011f66a88e754cb37ad49e72700d004c08900000006714a308d720178557951115850af16b504463ff21b9a34f1816253f2479cd72fb43d8cc14f62038bf9dc155ade0f233955e0b29202de70c6e0e402720ff11a39e11ef5607cbdf5f4b8f856a94c4302798149a43963735ea9419a725d04461fbcd7c3132dfe80a8780880e69b873f5a22cb88ab9910f463b615c712ba97e3be09f09e6afb2d5b79b1118903a4478834640000000686d76226d53c2e031aa37d8f6708018e3a85d8a49aea7bd2b2eee0c56ec506ab6571dd7f490f06f5134da035178bfa72e3682225a2a9bfcc895025b83ba26be	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432321633"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0349fcf3305db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F725CBC1-7126-11EF-AF16-EA7747D117E6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2764	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2764	iexplore.exe
2764	iexplore.exe
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE
2668	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2668	2764	iexplore.exe	30
PID 2764 wrote to memory of 2668	2764	iexplore.exe	30
PID 2764 wrote to memory of 2668	2764	iexplore.exe	30
PID 2764 wrote to memory of 2668	2764	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dca4ccf5d01396cbdd346f164b3fdc37_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2764 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d0a9685e40b1959b7feff701918c402

SHA1
50c187f065a1a895e6b61320506a0282386d65ff

SHA256
a746c3e6c359a18b7112fdd29a0b5a86956af97cb738df225943db12d5e56933

SHA512
0e9fb8ab4a059bde61d42216f1cf306a5fb6b8e6b908a793dfc9aa245d36ad3f0951ae7ad8ed6e0d0f85d35f3d1ae8c894b54665e66bb1b40dc3ce6e8275a381

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2675fa2add98dc22f739c11f0c9dbfc7

SHA1
164cf69e59f9f4b38185d41afcabc2de4c3599ac

SHA256
5ec0eb3ce98bbd9b37797d4ae6510f850a1b6e3522f4a4f080747b0d3c1dd998

SHA512
13c5cbe8a2cb7d16e69d6ceefc4a1d1d0191dff7ff43a2c0a64963c2a5dc60277ec31656d0424f072144e4cb8d3024a532642307cd445710b5ebf074fee0065c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
738688488700f65de4528797e0b5bbc1

SHA1
d4098129dd5ab0487a6b1d9770bc9549d38f18f3

SHA256
63c61d9e3e564ebd815402ab6453e41636c2bb260c665455fa1aea70df1c4c20

SHA512
918131005c58243fabb18287bfb10dcfb0342194824964d032838c7d04e5d29ee335f59c2c9f77adcf470f8961f79c35598827b61abff79ccab7977d15519ccc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f78a5752ac4480d58e3c2a08f837bb68

SHA1
db49382f7d02ae8a8481825e516ef77f5f8c91ab

SHA256
59cc49744545a64b5a278335e94df76abbbbbf5b2636aaef91f057fc5e083096

SHA512
63336aa1710a504ee92d6e508b385a54d92b71e5ea501828fdc23ffcdbee022891262bf21441e08116bafb7756973b54fb3bc427bad9f459b7ab85eecd2c5695

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ec61bd6b86deee991c49d76b6c1241c

SHA1
d0c4f9a8cb9030beaec96e753396bc00f24b08f4

SHA256
ae2bda6bed93738f4170d4a770e683b13be38607f987a072b330b9124a98f0a0

SHA512
5ad26c63b76516022bafda7953a9dfc22daec28a99532eb00a58650dfbb0b7542ebed839d008f0c9749276b163f08c8bb0f52182893300999d604e30eb754467

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ce59ea268fe72204dfd93a1c745c2a0

SHA1
49bb081c39287c2d8b620ff01217b53efe628254

SHA256
34b93b097b51805d3b92a4c13c622cef82f53378a0bec84c66beb4f4b31e6c67

SHA512
89229c8767cb8fe4b66693d33ea0064ae704e0237a6a2456d52ae41799f7d1c2af7f334f7c2fdedcac7c2b0ea6240be5db9464815a1b785f611d27a853054e02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8ac36dc6066740cd0de95f22862c46d

SHA1
3da0ff12dc70db4363ac536b38bc844920486eb5

SHA256
d12e80beadf44ac0d6b6dd5931c6a4fda6b6a837d461f61aa68e2507a022ddf7

SHA512
d8f8e88583c7a10ea5e8a35a0cc621aaac57d039a2c385789c3b42c9eff1edde8b07bc5b3333ab9affea6918418bcfa7c46477cb72dbd575b702ca5fc652f406

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6f578bce36b2feba29f43a66a7c11c3

SHA1
a06b322df9b234de14a5a6cd23d13ac44575116d

SHA256
d684e4890c442694fbf5846e68a082d86aca47740bd9c23e999e1aaa75c15f05

SHA512
6171fa578576901f480fe51257fb2057a3acfb8015a453484db290d8e0a18cfe28aa3be715a9847f902299d5501f00472220aaf69e48bc9ff5de9dc7c5c76836

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
610b7761a1ab1a73d882249077460e8c

SHA1
eba37def5412a6c93ad9dbf5567a7db5544a9eab

SHA256
95f5c990f673350b6374c40853ee3e16349c43da0c9470a4350d6dc82e22e649

SHA512
b244134aac03d2dec3611a077a3adea59cfea839c7c6d250b2891d2e3bcaa746f46d290bb984c2f6a962f82fa3175296ae64f61c27676b41558909f151e2ee55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d151da536a22c27281057e8ae64bde89

SHA1
263dc234c0097258061e85dab5b29cb1441e4141

SHA256
1054c8490a2b8c72364bf1a6fdd09ebaab9eea4432ebeaf4d2288639ecd81441

SHA512
0beaa88ab0303b7f038c5fc95d4dfcc97dc3720b4d39dc08fe7fd3c28e8d71efa91bd2b7116ae1d599be4ff4195bba4387b033809031dbea6991fcbed3393f25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5987f2ec5f57367353b90d5f616b401

SHA1
0eaa96bab864330f331d92c423dcccdb765cc649

SHA256
e6c41fc60712b500b0093b7e2f9b29a245a15baf44be3a6a7f59056858cbf854

SHA512
48663b9d20114101d812139e13fa013817c3e16c457fcbd1bce3807dd8905621582c9ac01c1ea85356c2772aa8db6e08e0d6695195610ad4a9a87228d7605495

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5527bbf524fb561abb4090f9a3b94f4

SHA1
123171af7241709e63c02ca0242068ebd3adc679

SHA256
b7acac68749f1a0039f270a28c016573f3492536a2a453a3871f36112d6560b4

SHA512
1a40db7b5e1e797b123605dabd71bd10d9b3cd7f6e5101da4a29b2c2e7c6adbf95903067db53645ea981917e35ee7f747e65d360ac346fb6fa148fa68dd3fbaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e278ef02b63a9992c86ef867bc4752b5

SHA1
2f73b8ac1897e16d41993bc0cef8ce27b2eaaa20

SHA256
81199daa307c8d6343febc7d3490c68888befc2d0d612ce00e6476f658905993

SHA512
11496b83434df3dfce627bf0d17432319ee8a7345edb268fb3ce75f9ff25d37946b9b0c5ee4af2c4aa6944b9c7738e6b43f55312680e0c722575c4b4c271d9bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ffd34ca8d1aa452eee3d23cab0b8f22

SHA1
ca627afabc9d6370ab09486556ddef570d4601dd

SHA256
cf1029f3f845b915e56a78a71cdf1050d8e9bc69e9347ed1308bd009aa0d091e

SHA512
9d0eb0949bf5eaac943de08d3e6cb711951e4f0f822bf583bbff63d295196c5e8a889885fd6b9b217414f72eb045b691367034ad1cd35c4eb845e4e5660d408c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b70abfffcb759f1065aab06d2a54f633

SHA1
1951d101344380d0f81b01f3717a1cf042ca296e

SHA256
888de22c3e80b754f58f43a2eb73e813872ff560cd24ed30baa13320aa557df2

SHA512
e4c4629bd4d10c7a275fdf6cd912ed7ede5a030e72fda290760f4cff84e3e8cfbf368506f9f22d16747d5b286d5ed1cbf19b908c07d6177770436dfcf82b65a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6ba23f46e7ec79aedcc1e70f660ec02

SHA1
ca1c9007fe3d3cd1ca1de166936642f0ce787da4

SHA256
736e0aba5b571e6bcc1d1cbb8e972a2e35aa3a1b7f0e3f85360fa7e58ab7830a

SHA512
6f09bdc0cc52561580e4d9e0399b98f73e358b254e5bb3ac11a834cd935e488dda529a8cba1b7a732489b03123bef2b1ed9a59248ac57ff1edb7cc0fcb9864de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5E2A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5F07.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit