49251d238ac204c1f4893597c902faf49e4c3db5c4b29f54ce8f80e2e7b41ea0

Analysis

max time kernel
141s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 13:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

060fe64245860ff34c1bfd0eb2d61ddb_JaffaCakes118.html
Size

138KB
MD5

060fe64245860ff34c1bfd0eb2d61ddb
SHA1

a33865419a25eb97e868e8d729328ba47ffbf4cd
SHA256

49251d238ac204c1f4893597c902faf49e4c3db5c4b29f54ce8f80e2e7b41ea0
SHA512

09c42f95b0fad269b249d711957d02071cdee0680f5cc18b8877fb23df6e5fe9b8c7ef3caea6022d45b1c997f7887bd1fe5f47f1081bdc85e34bafece44bd053
SSDEEP

1536:STNZMcDDlkElyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusG:ST1DzyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433952360"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000008612446b2bde8719c06817d144a4a61d27a702eb31e11a62b0c44180e2ebcf28000000000e8000000002000020000000669a42c1743cc0eb31b86d25d016d823113fc3fad3c9a1d468fc774f11988bb320000000ed813567cf50800cb3442f268982ba12dabf0d7f5db971ea70403534b41dd4b94000000098cf9b08feaf0d1caa146f3780140487bfb356120304f2fafb5c4cd9a0774dbb3566d74048c2962afa8a524e320585826bd1fec3a45cafd55b801c098b42a595	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1028a5e20814db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000003905ef77e9ea70a13a859f291d3d21e55785ab0176a6bfb4cd722622d97d3629000000000e8000000002000020000000621850dcc00a8db734c7aa5872368d7954e72228509e61a3090ebfc5d6919eb790000000593302a1b9767a38444be447a1d6eb3855d4574e843b4315fa00029e988de4f4b9f9be7d69fb7bdff146ed672269a3d431936dcc18ca3d78f6bf12c4f5bb463068ed2a137d2c7381765883d5a141b75a4c2a8046d53996666a8891978159313de30e8ac4d76dcbc91dba4b105d538a2845a6fc01378a4913ecb32cbb0dee3b4a7ce0d24696dc5e0a1fcac1cbcbb2b9d94000000075f916e2d1d4a904170d78f82ed9c23133958c9665d418e024a8cec35e751d539bde4b9431c7713649a5ed248e82a71c13111fb3ec9ca4a3d1da7fbe5dc57586	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CC444601-7FFB-11EF-87F4-7694D31B45CA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2776	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2776	iexplore.exe
2776	iexplore.exe
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE
2700	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2700	2776	iexplore.exe	30
PID 2776 wrote to memory of 2700	2776	iexplore.exe	30
PID 2776 wrote to memory of 2700	2776	iexplore.exe	30
PID 2776 wrote to memory of 2700	2776	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\060fe64245860ff34c1bfd0eb2d61ddb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2776 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da71761d6d4efabb1c10128102e5b968

SHA1
153789caa79fbd40e41f742ecf1169f97f7e2bcc

SHA256
20120184315f2637eb4d4bb9f9529c1d975a243625852e0d440ff502b24a228e

SHA512
37832668e411b7ebf28a0972e0046f0872159f43f09d1fc3fe7e95b7d93786662670f7dc099a713385dcc0ce1c259079e9af610f39f773ddb6290484b9ac78a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0cb9c3e0077e2109743520e15a4cf080

SHA1
a3b05994ff94a383c72b965becb6428b40b63eb3

SHA256
46a340ac4a26e2f73adaa1db2f84cd257702a47df9d4da273101d50563237497

SHA512
cd9059f54f6ecb8d21e4b6224e2756c3fe593d888890ce1ed2feb98b4450c02639209bdb97e6d69ad4c73578fa7734ab2bd32206c977155c962617d1a7c2e03b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
280c7da7d0a94edf0ca3a6f565dbc1ed

SHA1
6653b908009483bd748da57b2de0b13a1c6357e4

SHA256
ca7d91d9bd9b1f8c1bba0fc22dbc42bfb91087ce93055c5ecc83e555b21096c7

SHA512
540de45f8cf8a9dd5bc3e876add8a29ec0955a2e342d31d1e8c4c993704d009986b401b8ba7c65695168c8b9730ebe5c709e8e599db2231301d62e9a76aa2014

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
efc952f1c8ec81ee165fb812cca73812

SHA1
96734a48fde3bbffcc8a72d29ef5963052b88001

SHA256
541e222a90a098e43a9290241214693eac836ea56c3078081a723060fae2df91

SHA512
5d3716889f087f6054d692e3fed7190115ccc84f925046a54bdd25fcbccdb40b705206dadb046ba7239d7b6bad9342f9d11c76d4617c3ad3dee672ecce59d134

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b2f1f6d358ca311f1c6d1aaa0d2c93f

SHA1
eb75428a26db142c4140616f0a3b6106361f4d96

SHA256
4a752216c5bfbfbc73749b1ee737c2fc795c73e83710e283e3ed3977a42bc601

SHA512
f44344c62942096ee7149979e3c28682b1cbaeaeaecb591e88c36639506d198ea4ad3c14113a9c36e5ee77fb42f6400a1e1ca7dcafe257f0f2b3aa1ee3c11488

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb7341d755d031f35e7c6e5f07445d72

SHA1
6a593299e1021258fdf4e1b8a1f16489244a4788

SHA256
4dc71cf9b8917c70ffd24e2df64fbecd8b2159dd4814db01eb5ab0ef0b4ddb13

SHA512
ec140c3992f90ba58ed7f2e02fd77c09e05ea46db78f8cd94d1e4492177c29fa0479b9e64014aca28ecfd05fc0ea444a2b738ca3fa996bf2773d800ffce1840d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
918f9672ce450876616e30f10647a52a

SHA1
4bd441a73c94c1e8ab89d48b1cf503885f6b4f70

SHA256
9b2bd989507c6ee62a54b0afcc3dbd2dd3cbc483055d1b0cae9d57807304a3ac

SHA512
4dc6ce8afb5a79a0f3805473c0758152896c847e14e0713aa5f604d5e461d0a3e30093eb5f75c34143b2c205fdd9181cd04f09477d22125a7d0bcd41f213a9a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f12042c8339b495970fb87abe81f8849

SHA1
b69b3fdca8ad66fb7c11af8e3d1e46676826e8c3

SHA256
6190e41faa15d3988aee10f07692211e25fe31074f05379f008418a2f6837019

SHA512
f84ef16a24815a008887d909c3b76e71da6873c4fabac1433e4c08cd055e4197e9bed32a8e12dcae0cea3a9804ab5e00d138e9146c800a892ccc9b4160e9c10f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9288f27948af69a39bf7520958bc3358

SHA1
4b1093e4740ba427a62b72966820a7a25f574452

SHA256
1b099122e5d287c52c31dc28ec039babd28bff9a90ace605c5c9149bd77e641e

SHA512
eed2355ee8a57dde8c9ddbd1788c51336051e197f6a0523013dcff5074229f9398c061c38c712d31e7424b703b69732af0a80deacce8deb6920058875c1d0632

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cce58266340ca7db4b32f88dc4c8c3ed

SHA1
b0c01bd5323a6804dea903a14c58a9a0e7e5da7d

SHA256
457031ec35162b9cc5f06c954509c461d08280159161d973ce303754cae0e945

SHA512
d44eb2098ea0c877634b7e566bc31a7625ff3b844cc4adafd426457cd06142db4aff18dad86d084db66a20badf83d75ed2a383fa46552daf5b137f3c456d88ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86f14864638a10bdf5049ff988c8a6de

SHA1
ed11beba9deb100d4fd0f7f4d1a09ef4ceaf8e63

SHA256
bf4aa0d393b35c84052e68bd2dccbcd81b699aa972e24e2313918146adfa10ae

SHA512
3e1ff6f2ad32441bd29dd40fb146d34141393a4fd00bc2b9320bfd0ece8a6f19a8d9bf7c9bf23c5984d20dbc7ef931f1969c38aa9c79f49cb0c25cabe5f6c480

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0d46e5776c9cbddb85fbd62dfd2bd28

SHA1
3f689ad43c9d931a6e71faabe21a9bf2ddc7bb91

SHA256
a405772fb06354c36fd939614277be84aabb58c2b61fec52160470bd37b6cde1

SHA512
d81762a5120ce251aa8b170fe45ed3a7c6011935a413ebfb5a19afe134187e80d841c95a818813338750ed14992b6f197c17bf4f4750ee1ab0bc0456ea43249a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe4604ad530d2000d738a8f2559b20e7

SHA1
d348a846621fbdcf8b061f0fbf7299d3c813f7d6

SHA256
da7fb921baf9ce1597c055b1ed4fb25796a334ef956abe6cd0b4af9094381f07

SHA512
f4bf4b544b318e7daff8f98d888d970f9b1779877e826d484a4bb988da571f1d7e2d81a32904fdf560bd4cbc4a1e2b9627e0f6bc36f91603ce51f0f62afe64a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab906E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar913D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit