40b2c127b7412fe21b6b80a7dd6b054771dcc4d73dd8f1c0df9bbf8a057bb3ec

Analysis

max time kernel
139s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 19:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff3677711e2df2395780b73e2aacd137_JaffaCakes118.html
Size

28KB
MD5

ff3677711e2df2395780b73e2aacd137
SHA1

b50843b3964201d0de493c92a460111f9685d5cb
SHA256

40b2c127b7412fe21b6b80a7dd6b054771dcc4d73dd8f1c0df9bbf8a057bb3ec
SHA512

df32fe324898d0f90ed09724078c17eeeb6ad7dfeb35c2c2bb59375a4fb695444c6ea7b6c2ef6ce51838ef46725616a3ba3ceaf4cad221afa9c88c8a6a21898d
SSDEEP

768:t9sc10KlJBPIbub6bvRMqZu656rjICsdCHIzK8H+0eYGCWk5OumZCFv3uc2zzr0E:t9scWKlJBPIbub6bvRMqZu656rjICmCL

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433799640"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{394F45C1-7E98-11EF-A51B-E61828AB23DD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2688	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2688	iexplore.exe
2688	iexplore.exe
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE
2692	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2692	2688	iexplore.exe	31
PID 2688 wrote to memory of 2692	2688	iexplore.exe	31
PID 2688 wrote to memory of 2692	2688	iexplore.exe	31
PID 2688 wrote to memory of 2692	2688	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ff3677711e2df2395780b73e2aacd137_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2688 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751

Filesize
717B

MD5
822467b728b7a66b081c91795373789a

SHA1
d8f2f02e1eef62485a9feffd59ce837511749865

SHA256
af2343382b88335eea72251ad84949e244ff54b6995063e24459a7216e9576b9

SHA512
bacea07d92c32078ca6a0161549b4e18edab745dd44947e5f181d28cc24468e07769d6835816cdfb944fd3d0099bde5e21b48f4966824c5c16c1801712303eb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4CDB999205D9D10A97CB34C8B36C6D08

Filesize
504B

MD5
25326eb74974dc4bec3413164521d20b

SHA1
58c5d22be34e84cd20671f0f9d908a06dab7f80a

SHA256
964962e4391f3abe93759444befbc3f53a46506f07b486b5f07d2826f31aa534

SHA512
5c6f9301716272532558f9377cfe6f8e198518c9d3ac9d0e1257c94b594e8553be462dd19160c9636a27b2a03f7bf8dea6254dd190b9e3d1398a17ac7a64fb0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
899109ee4824d09368d64a389e91aee9

SHA1
e774f1032490cd4e1b26ac3636271e811fc1ed4e

SHA256
74b9168843405f60965c6dad04141998f3ada29f01480f23656aa368440d5aad

SHA512
ee2ae161266149654cff6cf338ad99660ded11895774d8a7389b0569e61c95a187475e8bb42b0fbbf5e2258a6d16a1feed69f492d794c12353763b3a22bbdc30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751

Filesize
192B

MD5
2528c5cd2e4ae5a73be85d72a43d7366

SHA1
f872e87b074aacb3aa009a5c2a860a3015cb7ba8

SHA256
74cdabb13fb02e16d2a64ec84e81a825d5907b4f6618728223ad903bd8a75af8

SHA512
5f96d1470e35626b97b08b8865f8648b82a9eaaa2415bf4414fc0d68aa490d9661ca023fb9e852ad737aef2ced7fbd5b411ba563a0416af83f1aba269d7037c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac02e1f223b61bfdfeb3e525dbe29992

SHA1
33015fe359e103eb40e9100be29a99435ebc71cd

SHA256
e3767ad538083af988917a01e87a844145e7342914ad4cacdaa006fa6ef9b281

SHA512
67f1cd51ac6c183bd0de46e1922982f0cd5ad1c90c3a4ec2afe7a10a33872b128118b3fa42026af7ce7b09db6791bc61cd7a10f3ede3b9368c687b043ccd8feb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1586acc89f4ad63bd0411035a55e4486

SHA1
07ea54a5798764d2766ddb2eedb84a6c72436e17

SHA256
bbb460c59701d8f0015a55ea346ce47e4a93c97c8ae8f2ac490b757935b48f1c

SHA512
1a6085df29580526df7fd7a1df0eb20c91302bb1873805bf74f9221e740815f9a9d9a55ad5b5082f8b8780d419e39d33c1a83119f742fd496ba5ea01d0ee9291

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
805c29932596380c7f3719bef51523d0

SHA1
5a13f3f000740c352c01e270aa6add8e90d964a4

SHA256
609c45fb95614e48c363b0d4c7c14bf966579bc934d738cfd4854540018eb226

SHA512
677b03e9fc49d82178a0d00e1356767ef9ddd81e79ea7e6d0629b794d342ffe9c23cbb63b8d3f47f6350e04967cfb9cbbe3fabb34021a53589463e0395697408

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e440603067c9b12c8782febf2dd63e5

SHA1
6bb0e1143ddadaa05691c762d09e60d9b6bceb91

SHA256
bbc0b41c922d3a583de12cc456462d52b03319bdb257c503b37cae40958aeacb

SHA512
f284335129ea3de1af8fabb82127b2d42c7d283d72cea9ad3e84da2deacb6ed782a4831f283dc04bb8315bd6b21c1774606808bf1a2f08bed8100792c3a1d719

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d69093cd55a0a920e1415faa7686b05b

SHA1
f04ae1b07db2f67ecdfb4adf7d8239c90393f1af

SHA256
93aa5f24fc59a90550446e077beeae3453d014b283487beea19bbc414482f2a3

SHA512
6f06f11c245d3d13f416c874f631d313e60bf5f261fb944702c9ebf233f35786a8a8cf9f09a88d520df514541ca5ff4837c1a8cc7274163694f8410aa09a3d50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f6c85e6ebec293acde6e5bd4ffb5744

SHA1
8aa13ab0e672aed48f8ceca972f8a6fef080c578

SHA256
3bbaa4251e2174f9bf11900186fe2895abd865476760fe1a4b4807b0c2360baa

SHA512
6fa4127e4f09a52aa7570c51548e007223301895d339d9338b8443b2870af2adda24e4a5f2cdf53a3a5722c454ed379f3e59361da5ff36988150599d18e763c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d63b733a7fa56957c9b32a92293f7d78

SHA1
9d1bf52dcebfc97abe3891dc3eee1241bb05d89f

SHA256
749e85f5aeb4cc1aab2617a8073746a9939b33ad054b387d97835f04e3381d2d

SHA512
bbd96ad32dc174e836268f4a447cbbf6150b0250ed46a35d38d350e89d9acbe3dd7240ab7a218d7fb3da241be6407a29a84ecdcca07d2f0a0980c90ea1de4232

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99c65ef16496b403e385c85db4a8073a

SHA1
7f657545e6c909144008992957c7a6ac3ddb1e97

SHA256
7015a37816ad43524ccc0c6e84296e521288ecd58dbd739086f709e5fe5a5c32

SHA512
a0ccc107923403928fac7df9632f17c0f74f58cf4d4cabfc831f81b1ab4479bbfa77334032d2ec30e4d3b2c0784ca3d0420bd11e1dd8ff7e239cc25c18ce554e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97ec2d64a9753ad65f7e447c8362f10e

SHA1
4f7cf67d371e8207f039320ee51f82a397c08fd4

SHA256
148f03b99d2dac244002b8b77836215bc2d96224f8ea40a3fe1e8d7e83607f55

SHA512
990411162d90cd3c08c570224f502f3cc87ba6674d20ecc0f8577ae8410392d88a739ae7db142088e97ea09d313a8f59626eaf254eb89bc68b5e86c7aa2c9b08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
999d72c23f897ede7cb7e5413f8aeb22

SHA1
8c1e4a969b7b2d172bfc24fc06b7682a69711403

SHA256
91f0e17da1197117ec789e221f40309149bef16c1133dadae2e047c120bf6ecf

SHA512
30f5a330f11518966ff0f09db5c06620ba778ebac803f4001f481fa0b7723919172841f503efc176220fde5d23ebac06cce3ab41a6b5dc89af6acbefd8731bc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68f78aef3f005a04fbb17f0fadcd7c3b

SHA1
3be36628aec1a2a2712d1b5ea999d15df73af2db

SHA256
4d2f5c586af7bf2467dfdbbf2bd3b04605304ad3a3e3b59534fe95897dacb38b

SHA512
f4ee480a5791f1a1270ca48685ca9b9bfaed3cc14d41554d4c028b10986027f1bb9fbf6fed84c22a8840758de6dab009479c0d37d3fad909cb16fa628a3d3c08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a16cf28daa204138356b8d2901dfa2e9

SHA1
87f08d8c9b3a892fc29879281c6ce1b22ee54778

SHA256
cacc9d3600a6f70474447706bd4aa67d2728c0341ff996c2b641339d94807f4e

SHA512
4621f24287f330e0778d335b82ebc4d9367051079633a9cbf2d42d06b8d593abd89cbe40790e1705f9732328b14f1ae18e1300c66a6eab1fa29e861114e6bff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EB0KZ1Y4\backbone.min[1].js

Filesize
23KB

MD5
a7c4a44edde567ba5c5b91254932af54

SHA1
170e6827c58e6bd15f0ee67f75694f469ebd29f1

SHA256
90554181b9d143453475bb69bbce45d406f2d2119409db9b71da8552536681a7

SHA512
f2bfac3dc21542a5cb7e13f053020f025b3d978b876894f17f3355369b8606e8c01cb6a7512ecf16f0c29de4c7ccf48863de95e4d49f206284cf9a1ae09f565e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WCATT3E5\effect.min[1].js

Filesize
10KB

MD5
6bdd4dca7cb09218e1860e6e0ca8a823

SHA1
dff6ac08d3ccf6f1d4f31c2d77ffa19e5ed112ee

SHA256
b7f28f2464e085279a304d2abee8f0c89f82077338dfe0dd44882ed0d53d018c

SHA512
69c128b655b22b150090d585fae2d1e2375400edac8a8f61a9fd12cbee07d464af43820bbf32e21ad55ff12087f9172f51f70943e301a2301c2e5e3a90993990

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WCATT3E5\wp-emoji-release.min[1].js

Filesize
18KB

MD5
b976b651932bfd25b9ddb5b7693d88a7

SHA1
7fcb7cb5c11227f9213b1e08a07d0212209e1432

SHA256
4e6ce5444c7f396cef0eb1fa3611034151e485dd06fbe5573a5583e1eebc98c3

SHA512
a241ebdcfaf153d5c2a86761145b2575cbe734b4f416acbfac082ae5c6eb7c706bd6ca3bc286b7e1a0f9e326729252dcb95b776750c4a3a0d81f2aa6258ea39f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WUBCGJ0A\jquery-migrate.min[1].js

Filesize
13KB

MD5
9ffeb32e2d9efbf8f70caabded242267

SHA1
3ad0c10e501ac2a9bfa18f9cd7e700219b378738

SHA256
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89

SHA512
8d6be545508a1c38278b8ad780c3758ae48a25e4e12eee443375aa56031d9b356f8c90f22d4f251140fa3f65603af40523165e33cae2e2d62fc78ec106e3d731

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WUBCGJ0A\jquery[1].js

Filesize
278KB

MD5
16623e9f7cd802cf093c325c511a739c

SHA1
b364dbd40e67076a03e9d7b061c9b2624d081e31

SHA256
1e7f83052e1e3442c4397ced9555033cd1d3f08444d85960683bcf91c8433cdb

SHA512
44b9d0ed3184fe5f19e650798e6fda22b71a6f316415e08c4ec88af3a4211e9fd335d5f9fc44a070f7b478d7060ae3b665c2d2620bbbce2ea6098bd6826b930c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZOGPI1N2\underscore.min[1].js

Filesize
18KB

MD5
f88d5720bb454ed5d204cbdb56901f6b

SHA1
f1952292fde4b15936e9aac16b2b9896684db95b

SHA256
726b820e44f6ab90ad991d30a4bf26d3a5d71493cbcd1fb1efd0d14e89b9df2a

SHA512
f7e3ec0c5b832116d75cac2a5a40ab6fe673cc6c0996bd898f25850ed5555484d821e1fc4ca039c69da3ab51faa25613d622db1177d7cde16da477145c3a6e22

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE5CE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE5CF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit