88356e9b4a8616cba2ca9149790cc4dc61c5ee852ea6da60e5f8d48c15bb6319

Analysis

max time kernel
137s
max time network
139s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 02:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df5cd9b1eae8eed0c1f44341f730e5b1_JaffaCakes118.html
Size

220KB
MD5

df5cd9b1eae8eed0c1f44341f730e5b1
SHA1

93af757eb5155cb1f4d3cc2dac52a54f7fd6ed47
SHA256

88356e9b4a8616cba2ca9149790cc4dc61c5ee852ea6da60e5f8d48c15bb6319
SHA512

eeb01c5284dca432c2c3cbcb774940b0c62ceedc6b784327384762edf238bd1fc348f52926b56aa27d07d601d71f61406a4e818177efe1ea82b9a206a78ec170
SSDEEP

3072:S6pUPh1nWAh9z+UyfkMY+BES09JXAnyrZalI+YQ:S621n/P0sMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432444437"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E4DBB7D1-7244-11EF-BBD1-D686196AC2C0} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2084	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2084	iexplore.exe
2084	iexplore.exe
836	IEXPLORE.EXE
836	IEXPLORE.EXE
836	IEXPLORE.EXE
836	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 836	2084	iexplore.exe	31
PID 2084 wrote to memory of 836	2084	iexplore.exe	31
PID 2084 wrote to memory of 836	2084	iexplore.exe	31
PID 2084 wrote to memory of 836	2084	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\df5cd9b1eae8eed0c1f44341f730e5b1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2084 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
341e052a4cd60b47a23a64e67c821339

SHA1
f18219eff9bd0cd872d1231e7eb19c4fada9fd0a

SHA256
56ff37029e624481a2404461733b2f1a5ec3dd6aef429f7d851ce9e42846d009

SHA512
b36eea5ecfc7e44ec50b521c92f312b35824b53e6e2f734072998c0973f878771b8478de1eb047c9525dc9689cf57a04de69f0cd8148cd8692199f413ac37490

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4cbd46c63bd1b718bfe3c342726234fc

SHA1
3f790edf0a568e8577ef3afb9f0865e354ceed90

SHA256
dc39fc68021c58fffb00978ca75b7543cc870fad447298d506f6cc6bf9e854f3

SHA512
f6badca3eb8d29a6a767b5c14ac33357d13760da8ab6c3a2cb97c2de471e33fadc0a6f5391d40b13c055e261d4bdb534db7eec649ad76b60202b51bf1809050e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66b24dc64c2eb1e3d65835cc3c69de88

SHA1
12dcdda507119c6ced0116774a29c9e749532b38

SHA256
764e3eb5c38f20bb88fc3d4b9fa3171716a77cb4a3928b2a7e1238ad877fc734

SHA512
f2d863443ae9bb86def791f22f6b43b552ee2965be06fd0e0c58468641f4da7f176c2e1327c000411426247417010aa21d31e57dee43775fc79c1ef4d49a950a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83630e6ef6e138cb2b6774906d4e4ca3

SHA1
e3c517eb0edd5724c8f9d7c9da7e491bed709388

SHA256
b6dd9abeb72664c5baf219792138b77482ca6cbdcc03d4029c984b568bc402c4

SHA512
a48005b7d79404745ce69a3b36df2fe96eb4ab8dbba821110b05b325f4c447eadd1123263c0555f5eb23195c6e8c9df37aa6f309d8393029f5892d60e3a35e2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61c962dae763ac85644882522c5e62ea

SHA1
f419fec8cea7baac2ebdc6875903cbe4cf013bf3

SHA256
c70f840a3472a4fe2acb81495f0394c70bdc580e2131981c01f4ddae3d499b8b

SHA512
3001703987bf12c80ba8d9087384bd35533ff09726288df245b5251c7279e25d55b35d480d9f85e764ab20463140515a0a804f5b2b798946218fad94cb07d165

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f617f1f104cfec40cc93f156e30e1137

SHA1
0844fd5625a52dc8c0326e63c7b066d28dbc2d1f

SHA256
162625a69b7b7d161a2a5f1c444ad8cdd293679cd6ad0a2d15f21e01704a5a85

SHA512
88dc6069b888893f2518fb9332b96b8a2aff375b0e087b7501468b65ade2c2b21ab2f6570a38ff5575e193bf3f55aede0b7cd7db3e64a4b8eaf946efebc74ee5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1193dbc312d6958e0bf7d4fb8fd2c9f4

SHA1
1771d16573792332dc72e2cb662fcad9cade4db4

SHA256
9273c956bfefbe4784eccc88d2c4364a99691a7bdc24e5d730c41d88581f58f4

SHA512
5cc5c8c520bde81b2b5691df2b42d716d4791067e93cc247361581aa40ca8d7081da579f21e1949f94373c22817ed8c65d81d8d46cdba89703df6779e9026dcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c3e8d6a766081072dc253918d1b96bb

SHA1
fa5856663c85977f21f8e43f3ea157f820537045

SHA256
5f499c76ce56e7a7de5532ff7c2c8215d5d43cfd5c2b8ce96fc6382b9e4819fe

SHA512
a15950a6402d0f4bae5b7334e8bdc51c95c989c370756b75c98e029cde7021b249dfc80f36b6e974d310b228b130d32e7a449b9750e1f0a079650bf98b1ea96a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ab716d7c25a40c6b738a49188f458ee

SHA1
6ba12c706d8f1d2b8b28d42af212540f8b50f129

SHA256
5e72b925b22d78107bb08a030548c9e261d73ae62c1dfa14f00b6d37da7415e8

SHA512
0a695663ad981cb68689b9a629297b23baf8cc07a4608ff7ba02098829511e067b033d6f3fc110bfb341ec1a74fef4bba773f4932bfb3879359f0ca0c295954a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
094b5c5d3ca62184f880eaaeed237e7a

SHA1
9605ffd622a371688150bf695c31c7eadde11fe5

SHA256
dbb7b56eee869799a3ae9222baec96353da8e98ac2d1f73436d3bfbdd26b86af

SHA512
0fc03270e9524f6be1d35037fe8d9218bf9026df5b8bc0b45991b6099d47ec1d045ea7646cffa149c5cb03b1ea408a4af4c78a3294e879533c965deb7b10a5e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57e4fc74dd874fd16b5c457783ebfb80

SHA1
2f17c164fd242ce7443929e83d505e82cabc8ddb

SHA256
727523ccbf243add6a99c6ed813fc9f5c8e8da39486176d3a7959650243052cf

SHA512
5224fc1d70041de9bd24a73e846af44c55e2263cd24e89c8c4bbfd642a5d64248fc50519ec4efbd61dd0d2f4d2d9db9e196a78a4ca3ed51d93f4db5b16da8c1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5d33c1314e8870c8821cdbd8b9c6003

SHA1
713ec881d9bad91acb91b830a0f56228e0b30df6

SHA256
1f8537392b06331fb7668c6770d38f646d72c9026d71b11e508c6391a5f27c55

SHA512
15a1db8c19ab3cdb3ab504b40760e5e3f00c16f732f3e91247b68e5620489c4847c5ab442e4967a8b67f352941e5d9991043f7da5c593e68fa2d78493848a8ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32df174d6c297d0af7103b36d1cce682

SHA1
aaa05d894eeb320d8b21318f9aa355672e790079

SHA256
db62c726afe833e9c423089e48e7a0163173d5697d6bf7504618c5c26384c888

SHA512
e8ba27b77dae08732d07a1fbd9dc4f1c2def7ee013541b7cf4d1517487629553003425d07d011470435d0af08b248a60b2808fd201a6b1d3be4ad42dd13bc5b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8fd6fefdab74f164e1a9d50c40d2829f

SHA1
28c4aa41a5026790fdabe90913a5ca7dca7a89dc

SHA256
3dddfdaeb6b22a4c32b6bd2a82ef277405a762b9d81620c92b2ed92b45ef5217

SHA512
380fc4a97565ade2dca7375f21d1b4db8c0042fb1df0d1115b5cf2e6f3e46237f16285268469784d66bdff2e6979838abc00a03bf704354b383b29c88514ee98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56f29017e17621340c2cc09f2bf091e5

SHA1
ddabc031f551079ef4a6dea531e22573950b390c

SHA256
55bfc07830be9358f28db960e3dc48830c4f34a7b8312750a93d4e96f49520a7

SHA512
b21335c467aa7fd6775b1a1c0e495ecd8591328b6d247e5668c8b8e1b05381de3136103caa6725ed78ff1542a24a634bf8387000e77789a78da07da5c2d5c158

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3855cdf49a372c68141d80602324cee1

SHA1
ee3311aa0dfbc5cd75798ee40056e860e482abf6

SHA256
00f19d9f9513de620c4061278560ca429489e537c5cd22f44e795100ead91e77

SHA512
d104dcc7ba85b8127a122a18d1a219bd9246e9a4d0ceb44da5baac12dad04f9b8dc7621f9a9a6d72482235dfdef1a8eafb7d6ee18f5357d40e395c4ba9b75155

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
412977e0500085edbea16c38bafbe981

SHA1
8276db0581220a62f8388ae3c3a39e907f2a774a

SHA256
d2fed584c83fc7b868e79fe3897cd49f064f0a64c2641c8192b4fd6aa50bf57e

SHA512
74aef2c1710e5de04a90732e7b95e5d007198b61f2f2018c482450dbc31d6515f537ae682d895153a9c2fe443fe60453f4098ddce1355091e8bc73c41afa0430

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9c0399a1937496f4838924b6adbdef2

SHA1
8e6a4f8a75435eb81501a0cb54b205229edf45b0

SHA256
355e119ba2ddc012f37cdbb9650949858a61f5c94d2d0ddc1b169f255c96ca51

SHA512
4157cc81fdaf3f691e49430acd34a4cb67ed9d33c461106a804265c516ffd440403d65bdd4f2a3320f93eb22890ae187045d6a02084396701d34da6c975b2091

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
195f9bc20d1df23ee5700dd4fe9c0d2d

SHA1
895a34408153df28b5d18429b1ceab3a8782fd7c

SHA256
0429244eddb2f9bba6032ca0798a9f4d40ae64e6c0c993f9b875b29e66f0a1f8

SHA512
feabcfb1a31a56aa5aa989b9560e0e4d1124cc1333c6876f4fd868a980e7363341a308b2821297063355554f15d2bd382e493641ca9e4ef09742afa042137510

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD069.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD11A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit