516949a8c9e6e1135bf559757591422aa30e0388cb22bdc9edcac7646a990271

Analysis

max time kernel
143s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 08:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef6aac49a6abbccf68a02b4604c6fac4_JaffaCakes118.html
Size

30KB
MD5

ef6aac49a6abbccf68a02b4604c6fac4
SHA1

1869cd9e9a94edd69b0aeaabf9f4e5869f7daafd
SHA256

516949a8c9e6e1135bf559757591422aa30e0388cb22bdc9edcac7646a990271
SHA512

3800baba91a05c3a3f2e8ac439cfb1c3754f2f67f11cdc085e5ddb15fd09a82194afcf2660a2c81c70b67c871d1b18c412af944ed93f33ed92b4958002bbfd25
SSDEEP

768:fqjAJR/axfyS2Ka02htwJm9w9mVhJCGkJHerMagX/ifQDqaNw5a/7fj2s51c3DJq:fqjAJR/axfyS2Ka0swJEwsUBJHerMag/

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0d7dcde000cdb01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433069424"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000ae5f8f20ec8a54826f14a9a87a1ae3b666ce6a793c56573d769368d258df704a000000000e80000000020000200000008631300be4ce2dcbef5b36f25b1c3aff3076956f038bfeba8fc4520082ccd14c200000009e7d6609208924a401fe749d63b34dacf68c85639d342b007f90ff5ba9888d0e400000007d1a8205f2e9d48e73c4f151ed3e7e41acf91ed62b97c6a739ebbf397359ed670edf688ff59bb2d1154767ef4b1079d8b99204688002fba8c1f83bb1c7f34537	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000e61f2a29629aab4ab45e56f252239065682f537d64a558b84bedb9f9db8f425e000000000e8000000002000020000000e18ea81b222926e85a1347b8f263c7ce4654cb38f6fc8f44cfbdcf3f64f9a7e990000000b90d45ece87f8f9d36e0307a62d98fa99c18f48974495aacb5d92549cb5f9e00523d6896fd5f24c552a2576ff027e11caa340602af2a84fd95fb4546f2ce13196f33e6ba0bf9fcac12c74175d1f0e8e5dcaa0578e27cb8bcd472841c2d800ed9f576895523183bc564cc64da8a9b0887c5b606cf5d71b01c18dfbceae5f547fbf71e99f799ab12d21a2c6c2aed0c135040000000f6efa95c075940cde34ac7b56652008633176fc9b75dd0b16306834b67b8bfdc59df146b0a2dd15f97fa3c1b6c4b8ac975c678df39b41b03013f7fd5d968b384	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0748ECC1-77F4-11EF-9E99-E699F793024F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
904	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
904	iexplore.exe
904	iexplore.exe
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE
2764	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 904 wrote to memory of 2764	904	iexplore.exe	29
PID 904 wrote to memory of 2764	904	iexplore.exe	29
PID 904 wrote to memory of 2764	904	iexplore.exe	29
PID 904 wrote to memory of 2764	904	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ef6aac49a6abbccf68a02b4604c6fac4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:904
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:904 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d179fe1490c0c0973944ca857fe1faf

SHA1
fc09ebf9fe70646b2662c0f2a086ab5cc11475b4

SHA256
6784700ee566691c69dfc0b8475f9997ef6862670b68195a9328a97dcefd2375

SHA512
32db65e5c78cfb49dd48f7e0cfbacc1d8aab0832dd29467847be67f40b2da51641dc94e6d5cf1d625bb26d5be4a1e60827694b292ea64d68eda657afc008d90e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
458f998a46b6bbc2ebf797064faa61ea

SHA1
9daae2ade6c3cd2410b2c9bb2b27a6656ddc05b5

SHA256
e1bf0a2ba461bbfaa2911519e9c43ac5d3aaca1a07e6944b98b64ce41e2d4d47

SHA512
7908811f0d0813d1cd7c4421ffd521c3568b31013c9737d2a9efb07ffb3471c7da5a1ef364c7c5285b5bcf62c8fd4e6b7aaaa3e7cf22de3c6daaa3c9e045d623

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f991bb304c0928904dfd021dc9c17375

SHA1
0b08a02e7f5fa8b84303a505f574528b132f467c

SHA256
546bf4fd62dad1f282b8f775e69df071ac29eb75cc1112043c1f020160dbe6b8

SHA512
fa6d9044c75f2fbf986e9a1c28e4f1a3e2e2bce78831422f4ad7aaf49c3fa0c90ad931f593dc649af02e551477f4db16fcd2c4775f980c0cd1110cb5f4dfa0ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f404dbe4b84c35f30120e1c860865df4

SHA1
cc36b940c6b397e5d810eb076db2fb1c198b1730

SHA256
d24d0bb5e96c603eb183b39d00bfb907137b1e03f3d18d58d92d0501ea763c14

SHA512
10c466d97fd9d7ebb8f83ba8564d5cec2103ebbc6003b4dd175baa4dbff77852a573db30cbdc9dfcfac96f074554c8d6ae78b5276a36b197517019df6461b97b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b6bdc3f1c6cf9ba3ec24f29f6210482

SHA1
b01eee5bbd540a8ced5bd2d8530799ae96024a8d

SHA256
0832d62f941d3035285ac28be1a86a95be119df25e091db52305ba93885adae5

SHA512
3daf90f7ebcccf71b0459f005c7b201868e86ca5f843d7cfd7e437ee1a621085044e553899e5873f6255072a9fee6cf5dfe87dba9b1670ccb498ee42320adb07

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2613ba0ff0409a0037b2f48f6040eec8

SHA1
5e0ade2ad7d61f87a35a7fb4c170122fb98adefe

SHA256
7c792fe882f32436dad0aebc8f6aaf367716c7377746b5989adc2c2f394d5573

SHA512
517cae89a434dc97afea66f800a09e21292f3383053098a5716abaa0f31af7f2723e42a9045356ee5a149a48bec6a6d78fbc0d58c200e7a652fa015a526fe904

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4cf7ae31805fa81de1f4d164fa72aa51

SHA1
4443c518e381890fd3e6b3c51d2928c8dacebb6c

SHA256
cda256d06c45e31b1be7a6b16a5f81d40817c85db11a6a8e44a88fe683d060e7

SHA512
91b7ff4bbb2c0a5a1128ecf86be3e6b5e88d6835594fcfd96161dcc03866b4b6335ffb6e30757eb4fac4cea6fba2e65636609d1665256a492e53cb76e9c54fbd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13d8aa708198fa4e9f0f9295d6d1b2a0

SHA1
5ebfa8a3c7ebd26c4e895c4a461d09a7f2e6d7a5

SHA256
8e9aa0b1f34dec8680df60ae224d8ed1aa550d4b138bb7ba0b52d8ec587ab1af

SHA512
c053a9f43252259104df5d02618af5dfa456989eef1eed3ea1c3d8e835a553b2360720ed3b059837c0d55e1c577bd3f231f65bd4ef879fb29299348ec056cb93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f98423972f8e8696f7706d33aaeeddd5

SHA1
49fcb12afbe46e1b7b36f7d5a844b289d88bd589

SHA256
56d773b69895f89c56286c162b2dffc975791479c0104b3d227be768d62890a9

SHA512
5b340e111f33de3a9f9569317ddbdec453fdfc22683c1bef81269a0eaa1d850a34b6ce4c5e342e20829edf79fe87eeebfaca5f39144a0ae76e0453c5e8b4999a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
632f5eefebf86ddded5904729fdfb204

SHA1
6de12c6fc5f4960a79d30dc992e556ee913886b2

SHA256
0abb0f71bdd6e715a5ef1bea8c487ee88174b9e9622c42b9ef250b94639354e9

SHA512
db05dd72da17697e784c6af3b958ee7dafa8a46c94131bf953e8baf20801570e8dcba882e54529e2eeef418ece0342e39f46dbff6820cee4774005fac0938983

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6471e87508db16378f7a8b0ec35ab1e6

SHA1
a5b9b3b9034d2d96d2dc3586d827b754311aec11

SHA256
5edc202521e8b6d453320df3ad4482d57df4ab8c48ce77b68acb3dad813f9191

SHA512
21109916c5631467f7f709165c2a4077d525ef373b7aa0044fadd376481de40597e868969e354bde7faf474b629cf302869fe132abf32155a8d492566e56950b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1a1d60557acd7183b83804e609acd18

SHA1
5baf5e13f4c9d8ee8d1b11322ae95b9828611ce5

SHA256
dc7cf5e8add9a58d326206e16c3018b3aeec8bb4ff43be1449a91e5bb6362f1e

SHA512
6d12dfab53afd247f32c17b38f988146430cbe7bb1efbe7e9213a5159416f0eacbc93175922a703a38dfebfd90eb71418abd8d8313a71ecbd52279732fa6ff50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef178f3e1c11d23b8cb09844a25f8dd7

SHA1
e2024c7b6566501fc545f7a15ece48d5b366ba08

SHA256
879685afa8d888533b17336a4c460a3a6816e6e2a18dbef8dd0377fbb4bd101f

SHA512
a94959bbc23320a5c6d59f2300c3124f6944d534385179b6b9f0466580b4f840e1ac28fbe95a64261e107086ef5251929ce90fa54cf3289e684224d91c9a991f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2bd5087aee97580c5c446db082413dbc

SHA1
7b729700d8b20a9d7fadea5ef201ca97a8a2f962

SHA256
39c4a912c787e3b2fbf8391be07945218ae965deb6e9c38dec3aa9a3c3889d26

SHA512
7aefeb67a704fdce48b710d2c1e5ccc0f1b9ec1481b74c1f3924a8f2e14857be50e3287c3c2dc89d74e023048397b4e28e35e3828f9e6713fb7fcb9832316a2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBDF4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBDF6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit