93187e2bf1d55c10c6d1ff0540ba08389930fe638f18cbbd3d27f6b4166eb724

Analysis

max time kernel
122s
max time network
143s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/09/2024, 20:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dcf4cbbe35f4ca106b34093c72c4f2b7_JaffaCakes118.html
Size

13KB
MD5

dcf4cbbe35f4ca106b34093c72c4f2b7
SHA1

d69ed5faf619069a61df89b7eea6a8924ba7c3c3
SHA256

93187e2bf1d55c10c6d1ff0540ba08389930fe638f18cbbd3d27f6b4166eb724
SHA512

3b8e3bab03fde0d8cb37f80cdb5a3aed32395258f35f6a374e2c8dc560e369ef8eeb44c7288a96918a68482fb5c82b5223ccf5646aaa44239d7227ea0cc7fcd2
SSDEEP

384:V3gE0/e6mGfySy15lWiZYBWx+LDrFJPys:VQE02D16Wx+RJas

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f0000000002000000000010660000000100002000000096f454de5512448f2ef330c8c8fed6f427c15c5079d1b07c5c599d8d9fd023db000000000e8000000002000020000000c0ff5b739e399dd46c97c602939d251842c4bb3da197285c30b42fa47d7cdfd220000000bf71d1c722446c043f4adf395966b2d7ae3a59934e4190cf65bcd61c941815f7400000000aaf53e325709c40268fb9e7397a424c218ab1045bc8f5243de14ef42b3c6f803c183984f1fad97337b420c65bddadec8a5c60c2e7a7ef5340c454b9dc916990	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B50A1AF1-7141-11EF-94A5-465533733A50} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432333132"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f0000000002000000000010660000000100002000000081c771d4b8248fae40a47e5ce39f85a55c55d4747607c67a31eff6dd05f412fb000000000e80000000020000200000002de5ddfc02b642d6b859ee68f169fef5fbe4a3e8b00174b0d4576b9b71207bc8900000001ef835ac5e86db440270669f80047b83c5b6d0f1239f724e6af45984a4bf0d4a701944e7c6d247f53380fcce18791d0b06165bea9ef6b972dc68840b8a961f2e163e3b7ca89e4e6c662c29dd61efe0aa4651ecebc865b926c6729a7877cdd3593e7fdbef796025cc185b6f35a9aa0bbf751ee8bdbe647719096fdf09584be41665f71ea11e2588031249bdc69710c65f400000002f1944ab8e2628fda985f93ee152b07e5d1b0dddf1a4248dcc0bccac2bafe0f3a3cb2872297ef3da44930798b2ff2a53bdaa4f2e32b2c7d33f6cf38bcd301d24	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00b04d904e05db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2828	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2828	iexplore.exe
2828	iexplore.exe
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE
2144	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 2144	2828	iexplore.exe	30
PID 2828 wrote to memory of 2144	2828	iexplore.exe	30
PID 2828 wrote to memory of 2144	2828	iexplore.exe	30
PID 2828 wrote to memory of 2144	2828	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dcf4cbbe35f4ca106b34093c72c4f2b7_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2828 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb6ff7dcdece3672de136396140d826a

SHA1
b160265022207479363f89cd43306e9227768cfb

SHA256
316ccc3b8b1a8c090e623372bbf7dfd10fe00bb360ca56006cccc8d0868ca53e

SHA512
b1af119520456a23e25a1f28da64420c37319ee613438515d8f3edc5978f47fe4f9677cbf6b0cc27e627aa5f1f41229979cc4e227ade96c88f4b2e8d901bc599

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cad8fe84e61558d7d98aec4aa997e536

SHA1
c6bbdf44b1f58418fa2724e4c249e8efd721854d

SHA256
d947a3ef66029a6a6655bf9cf45449ffe54a3807c9505d5252e41918e8e731bf

SHA512
fbb566d6ee55af7202280290d808659c26d30245315b81fbf1409fe588c59628fb27d9a7cc4c2983062ce28153a0b380c9faf74eb9b9cbb9741394a554290dd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
068f5dac3cdf15aa323ede86413ff61d

SHA1
1331fb2f473f22c9d65eb097b17999ab010bbead

SHA256
8de4604bf4a932d792ea9a30cee7815880de70a75bc22ef8f79ba0c62232d968

SHA512
308b49678a5068bd771354693f1dfab35957125afc0469681bf1b7792443d3fb4fa98d9f55430354068695add9783a6924f452eb702812565ea666a4e275479a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
970d6290650c7e14598b1c9c281d5866

SHA1
73ff0489d195787318bb8475b65d0529d40ff8f6

SHA256
67558c0a1fa9b9937249fb71d091431a8c167ab272caa72f74ddad5cea8141bb

SHA512
fcddc5ea2dcdec3efdff8cdc40b645994123db6c141d6716e3eb4c41fd1efb0ec398f028ad0662c38942423316a8e6cd49e94e4b3f501a2593c9ae1c142da820

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b63f4b0bf51e4b6325ae382bad9af177

SHA1
0d9a39e9d02ff8ef13824e9aca857b1f07405955

SHA256
7c62ed081863b35b385e866098aa963fa7013ead3c93c2e1648180c951bd97c3

SHA512
a92bfc27af8ff9f18d1a2ef9658b2b4a37c4c25cb13539288f1297a3a88c1b46a44c433a9d10ecb0b92fecf3bc60ca5ddbf4cde471be8e56257d9cc5b786a5bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
049de70ee5f1bf7d7d6591e7371c6324

SHA1
f2791c16db76e79c804af3f01293acdd8ca40e9c

SHA256
fb2b1c03354f105f552451d7e4d406e927164509a1bf72e6a52979202ebe0183

SHA512
b19adcc265beeb678c4fe29fb369f16d29bb5f1c84ac9bc71ba3a1ea03fb764b99c0ca93c8b42069c360414ba062381e13f8797cf95cc07728ed8441e112e982

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
600b96e666f1f56aebc8e3fdb0c51463

SHA1
06bc1efa91f3ba6067b81cc9841e8a7999fba3a4

SHA256
0e40992b4103cd5d5941334f3c665660ee398a57f422abff1df3b55755a19a2d

SHA512
f9e36834bf67eee5251f580693c49320e745e2520703c0b18a0b76cfd8b77cd2c2a12faa070bdcfcd36318afdbcb011dba746ba46928b1421ec2488e53b8c2c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7992500c9e4114317629777112d90d2

SHA1
9be87512981feb5c452cd39565b8f240d107e057

SHA256
5bb98dd9c21d0d6a1b25830bddb7140cfcf9c39925b8196f983112d63a525f75

SHA512
eb160540e61a3fae6dcbf3fb9ec241ca83e1c6ff9db99f39c7a0a40473c4f5ddacf2d304ddb487957c9586fabe4e6f5f4f9f88eebb41f4a78996cb0d9ef91816

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46b8d8abf614b5adadc4345ccae76b23

SHA1
3dfae5ed6c4a07839727eb36e3de1cb3fdcb6aa7

SHA256
4ae8ef5a4ccfbcf1fdc46975cd1c1e169130478618fd61bd10ae88587ed5a5ea

SHA512
e047f90ee92f996b2f7e8e6b076a9cdb2c7df29286b992cee5bd3fc239241ba0caf4a4a6557a0edb16d570bebf7b99657b5734cad22eeaf51ffdd43bb20f8f53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ddd9c26eea262333103bb0ffeae7179

SHA1
60c1887819247a49b2de2891e490feff1abf1b20

SHA256
53903f113014601f7f81df63c937b4f85bdfb48921af7cbdabd1af25546dc04d

SHA512
11fbd02988b9d5c9730e7ead6628380f22a319207dcd49f17a5a04a417be36578abe64bf03e307c5ff448c86a6769a1942fb8990ebcae029d9c1e70cf059825c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2aadfb33efeb40c515d1c4b62729710a

SHA1
85fd2bce8dcf02d149af1bf0fba40a99c86968b6

SHA256
7c12c8c8e041d07717b1511903744be99b46ff767976cb016b67cb40543ecc74

SHA512
26a34c9be25837244ebdf5dbd54334e431ae08adaff90e0d35e7ccb69181cf8ae58bb9089ad2c2eac3f9a2c441a0043eba350d25a49fe03e265dc44a609f0a48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e336efb534797ce6361fa6e160eeae2

SHA1
feae845aedfd21a00b73fda88d3fc5b4f56d79a6

SHA256
8a20ff9669d1ee79e634ecfec04c422f9b99aad7411a182006593361705d03ae

SHA512
b02afed381e17450c2eb457e577df9b87719093cadcdcb3e159130ed9f9a83f488d7128703b124ae67705b50034f5ca3f839973388ec9fb0d85aadfd9c92e7f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab429E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar434D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit