2c129ddea5052b9ccb96aa6c5431fa58e69b1eac5a86871e5bb13ec1424ddcef

Analysis

max time kernel
131s
max time network
132s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 10:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

058d7ae29607bb34db94ae9ebc0e36f5_JaffaCakes118.html
Size

142KB
MD5

058d7ae29607bb34db94ae9ebc0e36f5
SHA1

dda124df627627dcd10be2036d9f18805a82faf5
SHA256

2c129ddea5052b9ccb96aa6c5431fa58e69b1eac5a86871e5bb13ec1424ddcef
SHA512

da87fe667e0f201af3e639393a91a847c60787d90743e258528a89e26734dcb291193469beb63c7597edf79335190b84d5c9bc5a7ef20eb17af7572595576766
SSDEEP

3072:Sq45Yzx7dyfkMY+BES09JXAnyrZalI+YQ:Sq45Yzx7osMYod+X3oI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433942213"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2D67D811-7FE4-11EF-BE3F-EA7747D117E6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2640	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2640	iexplore.exe
2640	iexplore.exe
2956	IEXPLORE.EXE
2956	IEXPLORE.EXE
2956	IEXPLORE.EXE
2956	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2956	2640	iexplore.exe	30
PID 2640 wrote to memory of 2956	2640	iexplore.exe	30
PID 2640 wrote to memory of 2956	2640	iexplore.exe	30
PID 2640 wrote to memory of 2956	2640	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\058d7ae29607bb34db94ae9ebc0e36f5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2640 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fddb00b1a3ba848345f6d431c73b67b1

SHA1
3993f2a07992009c600b8cc1f8501343d87d75c6

SHA256
e9f3c03d0a609d5f2eeec6fa60aa845452d76005d4696610a37ef9a756e61198

SHA512
dea579b659bae37ed6608c898cee28e1482435fb691f4a552f263ec0080e851d330e8fd06d97629ca214ea90401df9a2d2fd1e06721c3649ef573316b5a580ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c12abe2c2dd011d91b6cd1bf3f4c3ce3

SHA1
4ee00bc78fff07275fae3473e7ca89ab78872a73

SHA256
a4c1103c2e7d4b6f0fc70ee7d810157c4d1044dd5b533ffe46cdbae44f4234c7

SHA512
223e92fc3b2e19edef2ef2efb931262a0fa8ee177f39a54e47530c5fe58b7a70799fba2a993dc27fd17fc993311d76f5be7ba115332ec26829ba37bf17f39131

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83669a3bcc6fc2c0c4cc8730dd67affb

SHA1
08ea42cad1d970a6f007f842f3b42d898f690fda

SHA256
94254d87d48f95cf368454a5fb54f700b7957b479ecfd17bd46a1e6dfd2e1764

SHA512
fe0775984ff140ed9cf61d7f9165455d35d206222dc23c51b5af22816d55bb76369db2ae1f120757375cd4611c63b268bb5a03106008a3b45f309fc898e49f51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89cc9f86eee9aff7c1f45fc90e0e7999

SHA1
cdbdf19cdff4caa9094139fcc9a60174f9a05d00

SHA256
2f28328a33c642d4663a0941a8222216ec4d7fca59eebee7f426404e6879ad45

SHA512
fce5ed3ed00ecbff432729182668dafbb1ccf6c4106cbe608f693974ae5c9daf927ab48a603e83dfdc006d5e968539c9e4f8b25497837c801424c13c5a5b1898

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e44d7dc66141268a6032b30025f8228c

SHA1
0bdccdde2c3d946c6f74ffc28002984ea3bb0c97

SHA256
402cd4bed00069bcf6f88c1c858c6fb5ea1c8570ea89a2b31b86cb35e43f9eec

SHA512
fdaa5c724319fcdf3ece1c8f9d33e9091308fe9c93a65d8ef03f8c413b19fb032b540c244a906c17132e6225955119ec8bb3aedc38f123009ec1b321c27c8edc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1bd56430b93f2f2b36f103b92298ade9

SHA1
9abb432785e90814b9d9d5ba5a3a2a794580e619

SHA256
45ef261411a41af8a41daea54c7f637205286a786950c36ff25beab57ad539e5

SHA512
dcaf6289b60d405bcbf97fcd8ebe9e193d84f2cd1ee4636b91a7f953e208df765d2e41275d57d2037df4bb3a6b3b63b5c3da72f5148bb219132f1bc61160a490

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de8730326c505ca980f9d098831c9457

SHA1
2bfb5df6b006b3b4e8a9196087095482b8ff947f

SHA256
71e9e9e3ce2d627664298b70eee24aee8edc5d187edc2c332bed08323b1643f2

SHA512
12f3e26c75a850e365b774ed42c1458eb9a2c634f0908e6bb46165d3f6e6ec05927261a9687403335af733c3c820c8b81224e9ecbc82a34c3c356a962780bcf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a34831f94aad59abe7d52f727d9fed4a

SHA1
76e9e7778eef0a6771308ffec8914d25d66d9b26

SHA256
bb410cba5cdab43ea36c251cb7064eb0b5539941def92db4fd08453662374051

SHA512
1581af6c31201e81296dba11c685f0a20af8522c107a95a23a1775711c62adbada8771b71d51d86624147f33264e72276396dbcd6e52838a386ee86b930ad2cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04915c2d621476b75eb753336e12ebad

SHA1
9ce2e44d53f06ba2eafa0867b82bda46c591f94c

SHA256
9c4e26510faf32eb8de78a49b216e5b474ffed3346898d35ce09d482942c35aa

SHA512
8dbcb4df4609d7b6b4461a4c2249bbdfe259bfd8908a41fc128381db00e4852d35102239bab139b8abc74c4be9934cb199fe8c7ed694aab32402859f3d2052b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9158933ebd142fbea239fcb975219c99

SHA1
8586080fe2868db028b03793edb1861697b99ec7

SHA256
c630bed2c2b7141db041990e41d488a1e92f5bbe3c94a1283f129ee47057a929

SHA512
87ab4d8122985d8058eea4484ea441523cf66df39a0a8a2ff096175160318c606bc667f23ea559e920f72dbfef2021186b7d53002641e494d6dde4a1fe88e7c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
949303b49291142dc1afc65e9703530a

SHA1
a5bcc80cdceec91b3f5882815ab88e3a69c1c46b

SHA256
cfef6fb719173d05963b47a9d4eb37a6b4befca8ddcf402ef346802226896d99

SHA512
7cc0cfa85e50470b61a61e0be3df7e938de78976818e074a739c697eab1fe924f9e00ed878265ebc16ef1e98e0bc0c9a8ac0c14df89c49b13c0c0aaa2000c357

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f35e2e726e36f671bbdf9788ecf3afe

SHA1
06f8fa60e1d5f26e27688756af72aa5c3b693f69

SHA256
02e347a742d52ce979eec065dd417cb9fa6599308e95f76c356ee6bc485b0989

SHA512
78b0697b7c06f1252c0720708c9b88b2e1b34adf9ff117dd62397f4830e17ba044cb21a1702b9abb5fac8e23f94768824b99e38f89cf9985746c4ef2088c5c5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62fb7a12352341ac91ffff7d238b683c

SHA1
92b0460424a1b793e66e9e06b75d1e2783018847

SHA256
35f2e909fb025138c8da49fc47e713b81c290a7d692d2d6d4cca774c6ff699c6

SHA512
be9f06d0248714e54f3e3adb8e5264ab4e45f811e09ba8b2240479e1e90ee41421aa46ff957f66a94f17d47dd245efe1046f29815a7fdf82936e9b62d30d8830

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0abd6ecebd81535a0e92f4787ef785fe

SHA1
319449aba3e71430ef154cf2b8727c6b3a8f33a8

SHA256
932d3b2711703931741d2c33ead66c7bad4ab1b06d96bc9b76f748c1456f6166

SHA512
a778043e6f6ef11c631d052f3cd7dc6d4c6a48cf3cd6c6a09ed87699e919418aa09485d52354e0a292dd4c170e81764459a7b69f75676649a35bf7b5064f84c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d64ec58f26faf97fe7694db220e22fc8

SHA1
7fdee6e2e29f72113cecde74854288026744aca8

SHA256
7631c0d56cbcb2c7fc1801d7e276372044c2fb91b38a0f357e689d1d07335855

SHA512
2f26678e21c73ff1b881217d5259d5967139c3cbbbc3b3c306cbb6dbaebdf486f1e4c027cd13ce22c437fb753989e788cb1d26430939fef699dd4daafd7267aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a543849f66a2ae0d29be3d6f79012a5b

SHA1
0e07555bb3276eac5890afaca8d0e7d85706a7e6

SHA256
f1cdf89ff68c6e7673442242301c7520f2e2645d56126dc9e95447a9cce06954

SHA512
04aa2ddc14ea698078fb04ef2f364b62c080095e832809861e02fa9104c0ca975d2517264e8601996a701e020320609d713a3dc02b35017b0043f64514c83eaf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ba1b4961db5bf9f06f8b8d452c34c92

SHA1
b7c156351cd044d42b55f0c512288ffb5c23f407

SHA256
33553195a1f71cbf19bf7452a89731dc1003cd4543f11b82705b6845eca95d7d

SHA512
39d6e20350b66a5039691025e8248f9a54ca9b79e2e66527a3aaccef42d2cedbc4c1c2ae7de76c401e50fe440bd57548b74797c2db5dfa1e85a7188b0299baa3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58750954ea841961f65a33fc7fc4caa1

SHA1
f8624c7b1c8ffd93715b3dfdf92a52c623d0f91e

SHA256
85e776d6fd91deb09f44cc60978e87d811805ad738f723a75233eaa22410cffc

SHA512
a8b0794d9f2967f1334dd68bf3769a657a1e8e9d93fcc79bef697c1684bb7a5366a5b8af329326e953a1cbf48268ce54a85367647c34587b4b85805779967527

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6da9ffaee52806f7d85d591c1a5329d2

SHA1
9010314aa2ed88efd70a845c2adac15832b161a5

SHA256
fb9293b6c8c1ea3a82b8b2edc59ebdfeecd13877e6e0ec55062ab5c453e12301

SHA512
e679da92cb2e5da3730f38a1ce1c6ebac8a2b577b9a8154a6ede8fbd57328e91fb719063b583e6c06da8100a3bb93c30c9302a5781f403a38ce4e15c9a1699ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab456B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar45CC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit