38e9c4cc0546803c665841d3fc598d87819c5cf1b9f95828981aacc683da337b

Analysis

max time kernel
118s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 10:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef93a7d0b32dbdb6fad3e3ba537d1c13_JaffaCakes118.html
Size

27KB
MD5

ef93a7d0b32dbdb6fad3e3ba537d1c13
SHA1

3297755d395e3abc297211a58a1bc9c70dbb33ca
SHA256

38e9c4cc0546803c665841d3fc598d87819c5cf1b9f95828981aacc683da337b
SHA512

52e10c882c7d8f8ea252bf4dbcef1e4ffc3494829f9861275e759cc7747a77f155d6393a585baf27d27efe2e927c1a748fa7eed0000efdcfab463e5746227421
SSDEEP

192:uwbEb5nvinQjxn5Q/GnQie9NnLnQOkEnt24nQTbnFnQ9e9Vm607HhQl7MBdqnYnC:mQ/38vwHISLi

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9076076d0f0cdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000749db58b3d24249047d280ce4496177efe705a1b762242ae57d47e6f9a25f9d6000000000e80000000020000200000000d756a6105003f9b0a0351eabda5267d19a117641545a39d82a97625fe93729e90000000d794611922479856f01f6c956918770c12122dd5fd9ac268391525a3e1d718e4e8657ab643d4c10daa3e72955f38205d2899dc980bc6e0dd83f69f1f99b3451efc103f64bfa5c4f7fb452044ad4faa5735cfb45044f4543d8c2b6dc6831ea394e8f8a0187c920506d860f82fe3c87193eb0424c59886f8f97a97a46df250b646acde85780f4cf34412a66fc3fc593d6840000000c3a394744e83742a59418aa6d5be7082e4abbc4d7fd5afa390d698fe5d8414d08d4d500d5f048bd8645ee91c7014dbc4742942cdd6c20ae06cde2bd67d59a0a5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000f65d7d960aa0a8076a439cdcd46dc42065566a4fa84dbbd1f56934fc7b1b738a000000000e8000000002000020000000df634874a27acbe4e64f0a2bb9a1d2f429b86ca1fd88c335fa08e1873456cc6f20000000651654641ffbf2e2051d5225b3cc710fdfa72b2b4d814b080c9fd9baa269c1bc40000000b29a2484409caa58370d4e9289156c9ba53021d72161ea9d6e570cac2e85cee7ff8951ec07437436760061d12e932a41e995d8d80a5cab44bc4b69d0aa518409	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{97178F11-7802-11EF-AE16-46BBF83CD43C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433075673"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2840	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2808	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2808	iexplore.exe
2808	iexplore.exe
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 2840	2808	iexplore.exe	30
PID 2808 wrote to memory of 2840	2808	iexplore.exe	30
PID 2808 wrote to memory of 2840	2808	iexplore.exe	30
PID 2808 wrote to memory of 2840	2808	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ef93a7d0b32dbdb6fad3e3ba537d1c13_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2808 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
857254b7456a2e79ca11f47bdaa0fe9f

SHA1
476a696721b9960c8f9adb7270e8e418b96d0c69

SHA256
9fb087a5eae980ab37205cb36e780e2292551095f564e15ef572ed46448d7bf5

SHA512
334ff9694cb4690e855052d301dc74a3d4881779f266051d992896cf3a23e6838dd77a260e827917d87b0e9392ae321558d246667196d02682d8e9600467cbf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c2631260fb83f086442ebb769ad2e76

SHA1
b0d2a6a93ec26fb55e323fd25fa687a40c458c14

SHA256
a4d1f05f0da21155e41cfb140541c504b4268e6cd63235e3a344f91b5be289a0

SHA512
8cced7093737aafd2a88ce174f6bd72caa788f3095ef4cd16ba82ec0c6c0007c220bea3358e62dc069ec14aa52e873459c2c0cedbfd50eb146d84fbbe8ba74d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f68d4016824d1e989d8b8b9776b3e6b

SHA1
5475e7f0adc00c5d338cefea2204f3a4c0ab9248

SHA256
837d6c439c7fcf4d06cd070a6fde222fb309a8a28034968cfe63246151f1e748

SHA512
1401c130847edc1cb72afce68793a16940d6e2ec70cf7eaa45ef9f4bcd68bba347c20df034288904f578b2b86d807d68c3ccd6adf7379e796d5b4f7a9f0339e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be46af5971d49f0c5e14c2253daf20b8

SHA1
3a57e1adeb968e9599ba858543f5cbe1d37a8f01

SHA256
812f2b01e52e2cdc48f269ca5c23768fcef1301fd216b15772c0125cbe82a1ee

SHA512
0fe757f737407ec7aa413f75ce843b90c374edde053cf9e7a19c1508d96c4b7351913e8f167aa05964431769cb180d2f881040ecd96f845afc95cb41b78b0cb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2df39a6e6a9dce034508998139f20171

SHA1
edbd06846fb819e9959f877f5749cc55346eeba4

SHA256
d9b19e6045742a6c58e06346da94609c9866fc2afbf94c0875004fb68f5d1f98

SHA512
b58746594e6b05385383d9dbb40a5446568c4fe5f0688e15220457a5c4b24719f10a881226215975be919ed001112ec3497c216df81bf3e1a04cc97b3e508d2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47270faea64a5006d4a30f812735de99

SHA1
333b7c1ccd52c36bfa41a2c5caa90eb5c230616c

SHA256
14d4a7335e4a81d18e10fb1b418e4d327411491a5787922a6151007162188fbc

SHA512
45aa9b56f10fc4f332b59e800724287e55b7c3b3d9038942a3d6805a4ff345bcc7b6446b4b591d697a888e8349beeecdecdb801240cdca7f5dee15ba01f6b113

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3c52c2a2ff658fe4100d1cc99946658

SHA1
c4c768694b98d4f9187ea98e0e292e8e7bd5dc8f

SHA256
8b77f09416f204a79dbad06cdc0d779f8b52933a87fdfe4bb96f603719c6dc80

SHA512
3e5917686629282abaa76a150456c18396b58de232799096d4d7eb87fab539196d1ce8f8afae61d7b57c06f495072f86d4deb6b363ed5e505a38778a909e447f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01d0f82dcf61d1e3bf38e235343e0bf2

SHA1
89038a9840131e43e10756e681d635ce075f660d

SHA256
fd822d7e35ee27791760c2381a95be6ca9a4ad11a1eeb0870ba5df72e8883360

SHA512
f6873993168bad91ea60099fa95f5318cfec89a469f2726b373e38c87124e7cab6fbe07ce9ec661c82cb36fc5fa3fa5d2e214d636f9c333d1c5d895fd01acbd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3ffce34e38b64639db08558dae1fb54

SHA1
ab26d9a0512523447c3dc12b1380ac88329df6c3

SHA256
dc2b8e47e5f6c1ddd5859396a52b212fb44f93f227dc04d985b25282eff2378c

SHA512
981fa85c4c869d5f0bdcaa01f5c71fd4ba632e37256343f90442cd6b0161f6d3b3b3c51138a4f576d96f261e44a8c52d553fc9a5888931baeed18067dcb3574a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
501a2e448007664d240730ae0b20b428

SHA1
1ffc432b2b690004a63ad9544315ac9d09e42ed7

SHA256
aa3e1c55e0fd8e21f43cacfd24b25670ec52b439ae24f5a87d4c0b56803a9ab2

SHA512
fca9389e1641f75d31a16d8c332807c7d2cab2af9ceeb7d02c02b29557c3ff5a3e940a7b56dc82aeaac8eb9c2b8c77d04c65898052851274669532805c11c112

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8887bcb04c7670ac96a3ae65b69e69bb

SHA1
8665fc3ab72e2c5ee2da11423a9ab15b14536f9d

SHA256
30ca8d7a0736ad40bcbfee41797eeaf748f0ab493016bbd9831c0c47c9a13bc0

SHA512
db9c49513ad9c577526ebeaa0700822fb4b8e64e5dc85914d9911b23d484dc1ae938c5f50a4a2530b75f8148757028d35dc0c0a4c3fe4e0f41cc52ec7645d7d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7bdac87ab20792c22012302ccda11324

SHA1
dda114db129b211d598d1df548a3ce244e47ddce

SHA256
9f8a9326586ffab00e2dd18b2e121f8c27fd5472d855987787d24b65970cbfb8

SHA512
899ed6f934e64bc023bb6b65903c4bc65b184238fd56332d93d5f64b293c665f8d7434684b8c469a7066dd907050ef77317dcc5297f28b55705e13ecce2af988

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0222fa6752dd345a231b05d7c193e27b

SHA1
7005070c2d19524bcdcb80382765e336c65cb7f0

SHA256
e20705810a914af184f1aed4a4035627ea2dfede06397d23d29a6d530e08ef8a

SHA512
6696349c90b416b7d85810bbe4d7e760389c361d94ba1c5157cf3996ea0e0ef9441d2d6b723f8ed99fbd9d2fa4c9834764595cfb6882a3d84fbb0382adcd454a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB435.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB467.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit