2168316f05156f99527071487ee921ff16b78c189deb5744a1593c0c89473b96

Analysis

max time kernel
118s
max time network
134s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30/09/2024, 03:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ffdcf392042352348ae5489cf404f370_JaffaCakes118.html
Size

9KB
MD5

ffdcf392042352348ae5489cf404f370
SHA1

87fba2e8121c737ee2ce581eafc19aa32f986fc9
SHA256

2168316f05156f99527071487ee921ff16b78c189deb5744a1593c0c89473b96
SHA512

57f6f58d2acd04c6df16092ad29965aedc764bfd36a22dbc7b51d1ba2bd3a37486a036e70e60b5b5f53fdb3174d614eaf67a19a55d13faac7d7960d7cbfa167b
SSDEEP

192:aHst3Oefcfdma1C/xcFL397NdcAGRoOQiP8G:3fclma1CmFL397TcAmoOnh

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433828636"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70839f8fe812db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000006883f7c52b235b97fc8cb91205f7ef4de15c15e01e6c011d66150263231902c9000000000e80000000020000200000005f6181b7a7ed32d65a813bd5cfdc83a3d4d6b694a2154b05b59b6c8ffd2ed86890000000da31e16367e0c5bf2b6635f5775dbbb0eb0962eedae3ba4a82809dcf255c69c012e69c2898cfaa2debedd4080d2f9f921d7efd322c461d35381ee10c06d5ad190e52d1c8a586319fff60e766b27656153aea38d2108b28dce7b1646e327338e648399e296190f7c26a995a8f8724d2a9e35186e2ae0ff5e626961281d6df69a32e3d1f19059cf6e5e8f93d513a945dac40000000d77b83defa3380c16df370b06360bca570329b687881dab1fe7bc0d29ea407a894ae8d4ae6bde6ef6a94234e3a4f1143ed30410bd8643fbd5df168399de264be	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BA9112B1-7EDB-11EF-A7B5-EAF82BEC9AF0} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000b58d3da6713f095729f74a025cfcc1793f3d083ae0956461de08857466e5f81e000000000e80000000020000200000009cfc25e3cd5cdbdde0fb01b0fd0091b6301b7521e364ddad91012b689af00aee200000009a4cdde28126208cfc67b49c7691ffb50c4279209a2fbec54dded19b3b92a235400000000ef6b4d2184aba4724d7087dceff01ab0e744663f624fd9b149b8ffeebdd8af4112fcfd4285f7f9d33edcd93e2c926095c7c5b96c8db424f66be1a97bba59445	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
588	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
588	iexplore.exe
588	iexplore.exe
1044	IEXPLORE.EXE
1044	IEXPLORE.EXE
1044	IEXPLORE.EXE
1044	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 588 wrote to memory of 1044	588	iexplore.exe	30
PID 588 wrote to memory of 1044	588	iexplore.exe	30
PID 588 wrote to memory of 1044	588	iexplore.exe	30
PID 588 wrote to memory of 1044	588	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ffdcf392042352348ae5489cf404f370_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:588
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:588 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
40c7ceeb31e6a5b6c7d536e4982348c6

SHA1
7faf0afe3e920fc577fb8cfe070077b1e369a2cd

SHA256
ed0e38c38b73af2e173742a419d91d7fb0d51b8fa23bfab410c883972ad1c8ee

SHA512
e7319f9e05b1342f7103e9ca53903c37ea20b9d813d27b5cb044f2cdaedd488ec126b983cae48accdfb1d32e001b7fa51e1b322b73423512bf3283af9e7bd3b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6310429a732021531432c861ed02aa8

SHA1
290d98fdc57d21bf89e8944ff7c07406d20ffa47

SHA256
3228750a14ddb6e1cfa2126efdf574027b7965501fad2e225c92465fe2429d58

SHA512
5a04bc5ed9eaad837a3bf9425dbdd91acb5ce82884d24bd414c54965db007d5ca7bd850b6ba896ac7b7c995b7dbc85952b47ae02a65b5f57318fc7de16efbfc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4e15839887c208641a80e9f3f2ba344d

SHA1
7b51cc34faba2e632c38a7ab0aea30f03535afbb

SHA256
37b70717e4a4c05b8e5bc91e06b83df186aeb63e445bcb15e933d77c1c09a302

SHA512
652f976a7f7644442853713c8aa664d7c06024bfd871aacde3e33cfc3d10d760515c0fdd93948973154ed02857299c8f7aa965df3582df8e3e9e7d9b3db8df4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a9720fbd90a3f1abec7b9d91916c30b

SHA1
8698da23091b6530d2bb8198eda2aaf51890a102

SHA256
41bb34d5d84c36b7bff15ebb11180d017fab944ff554188e5c4062833f1e726d

SHA512
4f5151888e1f20945e0f7968d593cba318f264c7134e0e7533518c9e6dbccbb22ee50ea77bde8d795085ffe523394fb5b4e06ac299819a701192b4cdeac76396

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b269d078f666fe17a840657e125abc6f

SHA1
61fe6cb197ff6aed9d6546cb99de37c31b3a31fb

SHA256
0776f08cf596b1b3341fea10f6cf15636be31e96784ab41247b96310880c75a6

SHA512
6875c9971eef06b8f714a8f7f479156b8edf52dd5f50c6ff411c9f12be68a1d7732139b18bf0c35470edd8406fafe14fd24dcea6477c96a409d67acaefb8ee14

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0891fe90ee4a539e31c65f53eef8d9b9

SHA1
539f35986c30eddcee03041aa4e3c4fe300ca370

SHA256
2aea2d18b563fbcc94d0fa0f58d4612aaaf6a80add9a47ffd03f256d1e74423c

SHA512
d2c7ff313e487ea12cdb4af4e38630c1588b4c7d9f6c5f350924290a1156e9fe4fd70e2f4af8e8c9a27b0800b1f05b80e271d005833a31c555d79da4cd0a0edb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
afca22098a5ce9648c75b2730eeb7725

SHA1
d566f69f9ff5a8388774c9b426fa42039f314996

SHA256
f6d0c876e79f1ebed9a09f000f052f301d44139d55d482eef51f4371f2bf9424

SHA512
a18c0aaf4869e9fc218bd0b3a5d0db5cdd47cbb69441f757ac0fbe224560ca8ea8951c35860f9b8903c9abc2640988cd50ad899ae4b394618a6e5612dc7bbb39

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
830a88816533dde441dda0521296a9c7

SHA1
d4807163936e876441d6b54ad7fb02f97332753d

SHA256
4a1fc57d4a7710da39685317c55cbaf4fba3ff07d3f998f17c1d54d836d76d01

SHA512
157f3fddfff857eeff8d0a7bc35902adf8e103d3d97dd14cddcbff8295c8b22683757332cf6596c0245f725b12212566df4cbb8efba046444ec47f50a3c7df43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a864712ca8a6821c1843c07bc8f38a9d

SHA1
94e0f285beb3f90591737d3a0dbf590839c9ebb4

SHA256
b89e4021e2c12883e567783975fe6b8198aa107c0d899629a465f45f36949cd1

SHA512
b146a479a697bb8ab4b7ef1996b8e008198e3928208b02602bb06517809c442342509e7b3ebe9879b3cd458fb952ec855cab772e4bc756d9f92b8869cebae5e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af197c84d78e8ba4d2c804ad023edd35

SHA1
1c99c884b90b75c5c54da4eec06ded3eedee3ccb

SHA256
c845beba454de0028c06b780cb92ed330caf819c5fbc3dd3717de3ebad1e9ac3

SHA512
1ea418cf8e6cf09ff615a2392aaced895608d3378ad5281df9cd752c3bcef9654d1efac4f254aeea0062bf781b9cd1f7c16d4cf99b31956f24b07e3ac1747907

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ac7358cd604800f3519c8333cb15363

SHA1
d2d63192c2d1fbf6fa94a65bea47a458954dbef2

SHA256
550f4e50555c7df9ef2d9d74de4522cd9dfda41c5a9a71237744058726302a27

SHA512
a5a4252e81b396ab95ab998330d3bdbbc7cd2a73f09e95c459ace990e686cdd99dd91bad8b477d721a503722fe306a1d97315fce0ce91e4d422e55c4ecddd467

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
039c1a88b1394fdc71a6f39d1e4fb166

SHA1
65f6f2f5a4e567806eff0a1b8af35e1294796abb

SHA256
1ae6b0328026cd9402dc95e8d0dce0715b185bb9442b09e045a451d52847113a

SHA512
6e7af93ad17e1e24f3eab5d739e04787b284ad9557481e26b9399147f89fb12fb51766842363b435406558ce4b3cd5e5e6c1798108dcbb338d2214527cfc896d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2cef12c4b9ad54a72108fc1c6e85ea2

SHA1
178f210919517bc337fc8e37c28076fef1a005f8

SHA256
b05fab31dbc2adc09420f5fe026550c2a37e7b966da76574f030fb8f66733dc2

SHA512
e452f92f62211495bb2df4a9016d2808d66307bce94f2c2c804e70a576cc6b1fa5aab2043eb31a8095ec2dea649bdb5996613fae6e5127c95d25bb48e2bf9967

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2bc4b1d9cd761989c9d31a9e17f15b1

SHA1
92a9169cfff990a57643746b7eb21bcfc041a02e

SHA256
ec10edb40e261070747b4f92ffbbe5c18b4c2a2a021f98da7cc18a3ecfc14daa

SHA512
6d3fd20559837be5437e02ce53758bf4b17412ae4d6a36af4be326a3bfcef503e49e0e688a078a4b2857e76c6a561851e5146d2e98c646a2553afc030b4f6731

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32dd2d3f5f4e9700c7037a24e05d3b87

SHA1
6446899195b9a9cfbec63558fc8af2d2eb4e57c6

SHA256
f61ea0bb4af8b63c5cbdd6948e14be2d18a8a6bede6b127d220f778d1fece77f

SHA512
27f2293710393a6fdfcb51d9c9e5e49dc4f58284ef0a2c283b212395cb5ea199829475aae193f8e7e0f290d29d0b1fad517ab2976df7289f54e416e1360ffdaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA796.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB409.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit