5229a489a902e64f08d3082a2444f62d6ac587d3ef7c3d772346a0fb6022014a

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/09/2024, 12:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

de511e7891e37c5f4c3a50f7fa8d3ad3_JaffaCakes118.html
Size

139KB
MD5

de511e7891e37c5f4c3a50f7fa8d3ad3
SHA1

42d6c031a494a530eea1984e769d93b9526c7833
SHA256

5229a489a902e64f08d3082a2444f62d6ac587d3ef7c3d772346a0fb6022014a
SHA512

f463375dd74f055b04eb573c7d028888d31c3c2b590151b9398e1268e849ddaca1f6884be95ac5d00e711241965492c92f21dd4908417cb833144fd7f97fef37
SSDEEP

3072:SaV2M3P20yfkMY+BES09JXAnyrZalI+YQ:SaEsMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432393715"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000641a72757689d56721d0dce4b74b4ec0c796eff3e519b24730411ffe0e352d3f000000000e80000000020000200000002b67d76bd6aec0510799d1aa6dd84b1efa24e47f3bb1d2f05c1a021bb39f3c6f900000007b78c478f18a9d23903dd9768e8fdf1201e0ae8e6de7aaa4706a1d500dde9b8dd8452d1c74927892a9e1b2b9e751a962d7fc064f02794064b00e806fc2fa65b9b7f399a785ebfc7e669712b1ab7db8e87052bc19a53f46c8ef644cdbdd1dba56508ab3549c39662ff5c273994e53878cbb159632c41e20a4262e3747263c7b2c5b5f457ffa3aba2ee02edaec619af358400000001aea8972e323800d983047d36bfd585e72257a455e4e3cc14e3921234c1d7c4494d05243d0269485bc786e0106882bab122a1487ca09de2ff16185ccfbfa3485	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb470000000002000000000010660000000100002000000096b48714f7df3a8fd9167dfcd3f7fb3f6ae852b6bc1e35ca8dc475c19a88610f000000000e8000000002000020000000d1881fcbb0e98b45370f78a3da8af0ee7cdf484450a1529385d62623cf81f50420000000a44e1043b62fe8d889983530b56e82a73a957f93f27af0e2428cd25ccc08476b4000000003e6ad4004f57c73ad6538203ffe1149d05729890d6df49a25eeb68a9e07d1afcff830925ad4bfb3ad42c1fe3a81e663f3228bb2b39ef1229f7b24af25b9a846	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CC1D2B01-71CE-11EF-9452-E2BC28E7E786} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f09afae3db05db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2356	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2356	iexplore.exe
2356	iexplore.exe
2072	IEXPLORE.EXE
2072	IEXPLORE.EXE
2072	IEXPLORE.EXE
2072	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2356 wrote to memory of 2072	2356	iexplore.exe	30
PID 2356 wrote to memory of 2072	2356	iexplore.exe	30
PID 2356 wrote to memory of 2072	2356	iexplore.exe	30
PID 2356 wrote to memory of 2072	2356	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\de511e7891e37c5f4c3a50f7fa8d3ad3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2356 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
898034730c4c6a147ee34bcca3144ed9

SHA1
92fffb0c4ed5f05f16148f5a9ba88c102ff4b7b7

SHA256
6c6c5cbfe0c0f865e8968f408af92a91fb94686e62b04dbbb76d3dfeced289db

SHA512
c5769450abc7b069f1804fb678f5800902ac2270842960db5caef66c33ed5bcd641880ef37c206f7e051fd46ac49b76dae16fc6253d02ab9d20bd4683bb182f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e84268a2470ffe448f5204863362e4e

SHA1
79b44919c9be41da5f284da9fd71ef49624714c2

SHA256
5f3a0f0a65faf6d82298b42e6db2de25cbcb732c5097cdf6fcdd9add75cc4665

SHA512
c264ff9be4da3d51cc3485dab6903fd88108a2eb98b7be2036f56f4c15d0367b8c978a08b7cdc6a09e13050ee2f706e0f65e71115f8e41d68ecb63d52af5aae8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
474d482deaa02ccbee0388d7303ec996

SHA1
d8fb699670050e23ef364ca5631cf0b92d7d6690

SHA256
6dadef793d1cd52f01587962650addb886488462df61f454b9ae91f04a5cfbff

SHA512
49f00e3fec421599834c53afe88cf2891b829b25262d8e1d3add4e612162e74e0dc5b865b9e6a13b194a30b3ada6fbb731bc91fbb5572f49c15cc9cfebbfc4c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
50a44e9c15a542a833e07374cb28d8ce

SHA1
01885fc5d5102cb82651f545fff72d0f7fd02efc

SHA256
f5d4d112a892c3c2aa6de2afff4b7f8da82f1de8d9606c4e9965facc4f2955a5

SHA512
ca5b936bfdf0e752aebc68a722c489b4b9cff6f14fb89c5c46d54d410a2dc16c19ccc52ea45871cdfc37326467b9accc7da4279773dc507d3a67d05d500f1380

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1b6751d12c6898717bffea6bc0524c6

SHA1
5cdc400eda353f957417c239e1480170108bd4d7

SHA256
82eff659f79e39e1b5da3b411e647ed61adc6192455077a4f0fcb3b4876ff8b2

SHA512
8387f84f0e8cae62322b01b089ac7c57f988fbed90f991df0696da65259c409848ffc2ff71ea486060d36b02da022b20edd662f655b6ac3bdb015c76b3262c74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0823cbc4c7a0c99a992e581b28ebe932

SHA1
8fb17c0a8485bb1aee9c5e25b784983a025fe86c

SHA256
7f5b1793628578e8de159ddd48c7f76f06c993629a9b4ceceb9476c61fcc1c2c

SHA512
f54cce4649a45536eb13767fe9b5c882179144e1d50ebb4938e8785ea19315737d271f2b5b120844997ad8918e413e716d74e7e43b0ffc329b32ecc43d5a71ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04c7d4e634e5a0d7af50ef728c8e699d

SHA1
2c987dd5a4cd35b7a63169344d212b160d1c9ae1

SHA256
76e65a79e3e38f2563d50664c0956f0072545b0803ed3f13be32585f5cd028c3

SHA512
bc3bcfc9de649cf2272dcb68d18cdc50a9bc8fef9bad2d7a43c7ed862ddc09955b7fa0a3be68bf8dca1768f8996e30d73e078d6db445622e594eb7e19682d256

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d77ec1eff261fdd5de289bc88e1f4ef

SHA1
9d7ce72bc3ab2b8db8a95dee804e46ac18341785

SHA256
f7c9e605d857a47c10fe00ed82af17ab6a1abcebd9020a86b290141e66b6eca7

SHA512
a677803c4411636fd2e2d0d6b8f200bb270ca84d071aa10fcf4eff4139c182a8cc5b51e86c3ab62d74cdb55f99c6d5cc363e7805d3bf84de45e151eb5da7eeea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0711c4d961068225280b8d5385f54a94

SHA1
877f3bef9a55350e970ac05cafcd8a83acef44cb

SHA256
11dad78bcfeeb3007bbe13218551648cc98eab7060f630bec9d226e0adaca3bb

SHA512
78c0673e0aa0617396f232186da2348eaac62ed1a8b50566247c35398ce9f27b7c19c64ae10ea788c00966cd04b71aab1f7c92f0ee1b20888a5f24e59ea285ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30683e91c9b69420dfc014f8fea979a8

SHA1
1984fb7ad79835d04226c3979763c1b7a6e93325

SHA256
717a9ee06d7f593541451a36574af2e456afeb4ab3b2f03864caa2f158175673

SHA512
c28da8b3c921d5f99ddfc23f4429f2c258f03b105b518e6b8b347eb7e3a58ae56540034b54209ead9219def9ef4293be9a2dc894b3e50c2f24068c00f0a65596

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc093950e1004fb38adb6a0164207600

SHA1
9318920939ebf5b39b84ab55ca2628acc45e777f

SHA256
4604ae5fb481595906730efe340b014706a149dfcc4f7c6fddfc97e61e476b3e

SHA512
5e67bc84dfe9ba7efc2512d9fdebcb82524903ab9fd435d9ccf47871b51bb99890841f7d9ae3e7d2532ef3096c01ed80a99a3f5f51d5edce5f4735e6ba1716e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b79288fc780695bd32ebbdf36791c8c5

SHA1
ca220094e4ecb76e04e6f4eafce8a296dc2c9db9

SHA256
5a1a2529fb98f587c06b94c6fa9af370a576b2864747de057584c608f48918dd

SHA512
ad530965133ea8fdec0a11cc3a315eb9877e4f053f505f67d3a83b19cedb49c91c83219e2126fa5294899c7c951caf3ad040f82771e82a4ef376c9fe2310a5c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
386dba9edd1998f8ad9ce092ca506765

SHA1
8e98539b6a5f0423c34b0a6a0714f817f0ab5211

SHA256
3995495a8056b041ec3db1a494c01485d9fde62c9103d5469e2a600e77a23dac

SHA512
71720865eba591884210d7637c14c0e46cf0da4dc626d53c80ac3096dcf9e48dcfbb3a56f73af76f9c4ab800eb8f31bca54e4b0c4680394535f911271ba698ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB377.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB428.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit