95a1b8c72b5ace66831cdbf2bf0f94146b6fc4393fd8eccd7f4acee90fb873d4

Analysis

max time kernel
142s
max time network
146s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 06:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dfb3da9c3523e8e2b93e863a5a36df34_JaffaCakes118.html
Size

7KB
MD5

dfb3da9c3523e8e2b93e863a5a36df34
SHA1

ff46f460d8f07491d59b30fb384012f754d6f5c5
SHA256

95a1b8c72b5ace66831cdbf2bf0f94146b6fc4393fd8eccd7f4acee90fb873d4
SHA512

246673e1ec79ad818bdb364e73b76da79362eb6757d017a7e611a2412ee172e10336fa647beaeb35cf3558885d2a8ee3f5a9fedfc36603085c7d3be546baec95
SSDEEP

192:0BPSea7eSutLTwypNIo5FriIcO/gjt/gMMMSi/ze:0MVaTPvcO/gjt/gMMJy6

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E25B36D1-7266-11EF-A1D0-5EE01BAFE073} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432459037"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4034afb77306db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000000dfd8d7eee030748e351784bcf5c2f42936fd8f28ab53f00e1eec27d05bf1dbb000000000e8000000002000020000000fa4ff746e8536c36a552b36ec6dd172fe8cce047b91faf78e9930a73e0f2547990000000791aa45604fa8c9c8cef1126ba46e8a09183606020affe94f1b0adba74819b7fe9877dc8abb1e25c9fe55ce2502ad43394db06956134589d2897a538f2a866eb2a2583529ee343c7aec2b3fea87495892c1c61087adf83ad8ef2818f8af2f4e81b635900c6d5f832c682bc7f5cb02ca4c924c1f5f481b99b542a0b22ce255be1395731ba1ebb702ffb885141a1f49ade40000000ff056efcfffa03d1213615c78d19c6dc5e0ad12da65d4bc7225bbdd4f4587fb39fe3886bcef2a48db56c8a4de6f404950e2e3379b9d6c07c30563d500d5ece8b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000008155eefe4ef5cb2680950703dd39cf6f36d26cb36dd3b948970e7a02db50dc14000000000e800000000200002000000019196dc88e7b5621737c07378f7b1a5ed1c3ba01daae53c73d575598c0cca93c20000000f84ee206d895441c337997ad8795140e39a6c5029118bfe6d429abd329cc79f0400000006011f450a4f28505744b7ff8a46148fcf6c3748b291cbad2b68933c98a4808792153ffc07a91bd2f59137b109bf1519a9dfb3ec36771d4c148370bfec04bc275	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2624	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2724	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2724	iexplore.exe
2724	iexplore.exe
2624	IEXPLORE.EXE
2624	IEXPLORE.EXE
2624	IEXPLORE.EXE
2624	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2624	2724	iexplore.exe	30
PID 2724 wrote to memory of 2624	2724	iexplore.exe	30
PID 2724 wrote to memory of 2624	2724	iexplore.exe	30
PID 2724 wrote to memory of 2624	2724	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dfb3da9c3523e8e2b93e863a5a36df34_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2724 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfe9bc2e09e2211252a59f8f63f4930f

SHA1
a5691e8162b53f4e5c61800f9a7d2e307574b60f

SHA256
f0d9119c55e63204fcac60579d3bf18cabdeccfd9bd451e11de200dbf102d785

SHA512
fb78b0072f3fe7e08c4a1257d9773f80e2b2e9d7ef336d141bee56cd5c21604c3b301ffb92a3ebd4e128e265f45ca4dd096bf2c25ad58714455645f8a747ea94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5b46a5b1e188b12875cfc390166bc165

SHA1
22947201cf4dfbaa717174738a65553e473cca4b

SHA256
a3d3d932473cc28016b4a8a563a81ab60ab2ed693e253f7ab14ecb5723adf69d

SHA512
1253adc867722890862a9bd8aa7ec527f2d993b45937bba98a40c70d215b8994313dad5f1c08d337d57afee9fc9075a274809dda21d23621871e0f4522ad4861

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8a6a2bc4ddb1ac69c995648e15060a5

SHA1
21726f4d35581de249afa06c9f12ed0c71877633

SHA256
b1945028babd7027205b4638b9c3bf9671c7197f2a45a2e148c24e05aa948e57

SHA512
dd1e344f0c4dcd895d866018cefca5256282d492bf1578311a1d33dd4e21bc9c2e6b6fbc8d5898eb2d7f8f02901c7c7afd82188cf477584c8be0cb5f9a0c65c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1efe76331626edb8ae5cbf54bc8c2e70

SHA1
4460eddc3b493b2cef37451c40a1af526ec84a3b

SHA256
ee382aa416c1fadd5e2bddbe9882df346e8fba330b065de511ab94221253f6c9

SHA512
06a31120339305a69af076cf56b397d402c48039ab2104dcab2f97b922a9169455dcf882059c0bb6995242e9047514414ac31a1975cb1061e7d5e73ad86234ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56860e192ca507f1ebee873c1e465586

SHA1
9a4632d230335995891dd750f64ca33b297ff191

SHA256
6f4d542e016f4b338e055be53dacdbe03c349e7015b56f6c0f926f809e9be13f

SHA512
62e1c18a37f5c004bf75229e70a7f011474b88a6c696480a44439480a59645b06012796a08d4a0871142bd9b8203cdb20f11d6e1650045fd932588c3ac41a7ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a26477dc2598d9b4c8e3cc86e93abc3c

SHA1
263b6960ef535cc878d788928cda15052d0ad238

SHA256
e9cb316c103b453ad3761d429b28641187166af3129778965dddb78c7d573761

SHA512
b63b2e37841c1b3fe204bb45e5e014ad24991d86728b9522c468f0c4715a914d9b0439f6e3281059e44aded3ee41fe806316cbc6c49e94e95bd6fdd6f32987b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7b97596c25e3e6c3aa2514ec91374a0

SHA1
76187cd4598eb8b16555c25cb5a112f104897c8d

SHA256
82fd56ce09225cf030db39afbfdbc4bf3f4337d3347d2977d451a3c30748cb60

SHA512
4dfbf8f4eb7a868cd4992787c10db4196507dd769517e416b64ffce3e55a6132aa73684e08986751fae48c99add2bcea57179a23b5d3e062cde85a13812ffd29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a21f7c6c9e9bd76937765a5318e92be

SHA1
68040c7820005f14962f5e904246d0e9ceeee512

SHA256
70628359796cee808d52b0abd297cf14f0f8f400f77f75426dd9e21bae1af59d

SHA512
92a12d23d29570d19195042b89aa48934cd6d2238105ae068c073744502daac458720685c36d2acc167e6482bc189311ab867b8ce0f6de5a76202c76a6623d56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c61b28606c635607da7a367930b9eeb

SHA1
d71a69db052a89a654fdb9e837948406469bc0b9

SHA256
e25939220dce435cb78f9c1e290570112c3ac57e6294803de0840bc48db49247

SHA512
d1ef3d026945f89983dbacd10788389a4fe45f956c3a37f42c06174faa6a6e92df7343ec737306d6fdbe3dcb0b0f6e2b70a1678b5b83ca08cfe4f63ff5b1f7ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5143aaba92dfe0ee4c5d1da1f5d9a7c

SHA1
cc462745147412a256a3a02919943f9c987ffc2a

SHA256
1947d96b00d9f0081a87fa3f9dacea556d393ba38f612b987cf95daaf8b5956a

SHA512
de12eb9924792670af2cab14591937cd89248421894368a79e9686cafb28a979d907cea7739d084978fb3308c7f652d84f66467555904bcd3e248c44e2fce0f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e68be0ac220b9811ac6906beb45d58c3

SHA1
808cfb1e6359f5861ae712ff31bcba681e137c39

SHA256
eb4c97777829a4aaa306408b2a42b2ba82af4235cbcd3f0b23f8fbdffdb6c637

SHA512
f7d0a56d63de1f989779a5d4a56cecf3cd494bed5675eaa4aca258d96272bb1ae292d053a486f3e317c2b4df925e14752fa18dce174c68e9d398b309c1fd6fc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b056a135e7a05ff461ad389e5a44b62

SHA1
f45689b0e12112ee3386ab6b86975bb7d89f82b3

SHA256
f3de6db276a05b2e194cfd6e3c5b0dcb62ee61f6ab62e5ca6b91bd84dd709df6

SHA512
3fe179415ce5816d616678160ab25862df9bcea178443310ebad17c5965623db34159337d0ab9ff2e5dc609c9226ca762f5d9466d01ad9b205cbb51319a3c7af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55f257abc91c66536433297c29f4f733

SHA1
cd7aa2d3a9679854f9c17f2315be6aeb30470e53

SHA256
a792578cb40c383ec84c6a8b707d62c4c0dea90fc9a3192eefa546b4dc8d7dbd

SHA512
6debd69e9ecb159110fae75c07f59427ddb256617aa01ab0325d913e82bea082ad3143dd0c079c2a03d5e784a23986a69c45a826a4106181b588430f6b2ddb15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb5e99a8c8048b012aa08b8828d11afa

SHA1
ae647f1060c780c8850357cde3700e5488355b47

SHA256
6c97a8fa685402ab86a15848501f280573c6402870a546de44f83811ab190991

SHA512
555ea23c7e16a7c5dc34102075189e62b40390821f78e5e3ed26363c75370bf81e43d16984d764130f961ac2c0af74b18b553690657d76ebbc4655a01c766e2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
786525b22c964cf2ccbed6a02f52d8b4

SHA1
8386339e618d081ae41cb9a18e3a18ab94e9797f

SHA256
d905f9cb26f54bc3ac03a2e4da5bf0605f7cdbf02faf99743b54c56c5ea728bb

SHA512
64e1af9455554488705b2010351e40af7b13378904df7869c9b6ed111caef775e2dca8fc50b284d3557496ae01acf89e79bdb0916714ab1935285193dbb239c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40da145e75bdfb3c68605a9d332a0ed0

SHA1
c5a49525425f2b6bfe9dff81f8d3f981df658b4b

SHA256
d9f8885a8bea171672e27daab4498535d0094b5793fb85a47979419bb318d085

SHA512
2207ee83cbc7c768a2fdc8c334437dd55f9ac011f61a654fd479738b246b56daf40d6fc33f1a00f19e8980de7cca532a40cabc0111b4f54691aa04fa5ea11511

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5786.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5844.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit