6d8c79fb82a93a6fb00cc8ea8659ce14ccc2e3f488d7a1348356be4cc0e338c9

Analysis

max time kernel
142s
max time network
135s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 18:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

06fbae0295644ee67a37a87f429c6abb_JaffaCakes118.html
Size

20KB
MD5

06fbae0295644ee67a37a87f429c6abb
SHA1

918ac12e1d7fc88479cab57067c66f02d185ea3d
SHA256

6d8c79fb82a93a6fb00cc8ea8659ce14ccc2e3f488d7a1348356be4cc0e338c9
SHA512

c16c573a2fdf7a4ed50222cc4ace36f08bf3b38eddfcb518047eddf57369d50a7cc539619f46ea82b188666bd5385c290d8e35a7da85121f80f2bfb6702920c8
SSDEEP

192:N28v/VDkDSal/zYPf4I85eVgv1sToRBzYbcqiwqVs6:5guy/5IO36TofOTm

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433970669"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6927DF21-8026-11EF-AC30-EA7747D117E6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 70bca33d3314db01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000006c80f7c9b8eb300d1391513d17203bfc8f29b2475e1ba8cf40d60e198705748a000000000e8000000002000020000000c4ae1cf2dbf4acaa8d8bdaf124e3335dea043220816faccf3c5c8c962501878d90000000ccb2c9bc053ab2293ec3974656534d6f65eab5c84e32f48649008fe44a77200f3d7ad31f2704d6bc20d3303e2928f4eab54edc661c74c083c9548fc41e446213ec99d33eae0dbe5eb07926d05b96e519c4fa669df85033f0faace326eb72c48c24be03c639842ffee83244113382b48f3fb0f2d78d294d7e07db32a0f5561e981f545082a8b11eb4720bff102a30ec4c40000000680c06a127a343f54754c6f144e22f23a9f5a53235d0db0d1c40e2e37f6ac5557c71b8e8bcaefb7ac2b13a4df70affb7d219b632bcea4d51ab2113e750f71548	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000006a1a9094a81a8935982fd929923bf1ca21129290ae47fd6160e28e3fc2afe2000000000e8000000002000020000000d5357dc2f2bbde6375112b2b6b19eff600f5ab84ea4a92bb0ba6062fe92ad91320000000dae4e318166a2b0085f5309560a8715ff05b558b3b896352c85708983c7c74eb40000000e98451bfe0c52efbd804eb190c567bc28b971646ccca96b7b911662996c34058b42dfebf2c3f270fba6074ec6c5c3c2a8354d0ca5476ccc94c03dffe6282e102	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2940	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2940	iexplore.exe
2940	iexplore.exe
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE
2872	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 2872	2940	iexplore.exe	30
PID 2940 wrote to memory of 2872	2940	iexplore.exe	30
PID 2940 wrote to memory of 2872	2940	iexplore.exe	30
PID 2940 wrote to memory of 2872	2940	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\06fbae0295644ee67a37a87f429c6abb_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2940 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
490bdc6f95789c58906691f3146c7249

SHA1
827534151837c993137e2f4198faaab219a82592

SHA256
271fb0d28737e68a5c78be74d9198336d2aeb594e99ef55a17a4b86de60718ce

SHA512
25796198d60bd83421096179083cfc547223b74464689a6437806cdf894a5333e6c867d59c50eda5ca8fe4c1c3db943bacb1f07e9d91cee42d64520705b92a9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
068f5bb570be99f2c9db44fec9494b94

SHA1
53ffa3a3e8cb574bff7c7921a383aa8f1710bc47

SHA256
c743d96fba55ef3fdb13591b3677f22a3567eb1f5fc4fd0ce7ef06327448f71b

SHA512
dc10775f7af7e604ed4e29c3b1d6c4b47d1f6be6ec0817d40b28100f1534ed24ec4f0ab92ac60301615bda7030e46c16cc77a3938cd73d9f4a43de0696bd1e59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16227d4dec448be9d822a3ff5d37317d

SHA1
fd8ae5a42771e1f48e742f9c1228217676823478

SHA256
20cd121901141a190ab35544daf80633d1915e06615b02c0afc7a931cd4e6dec

SHA512
e7e8353ad0a6ec64ed185774f33156f66ebd7da37b3d9e54b2566b9ed2db1ed5d83d14f851541d9a77369ccae0d8209670fcd06798fe6a1c4547290f927ae0e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4272b12303b6a3492cbf5990dbca55be

SHA1
d72433c2e64bc4f425e24177ed679aecb75d15ee

SHA256
78ac11289047122548280ea679cf02330833d22ef0895d297fb53c60019f0977

SHA512
f49a7455c2c13eac49b0609a1d4269eeffccc4056a86b46c59b5800dad8df8e123087a3809613906a9b9a3bbc9818a81ace1c9bf026bec3fcf093d09860a4a7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10ab050d802b558181916c9c18d17122

SHA1
7645077e10b5307140c03dc6fbbb4787a7d91cba

SHA256
11586ea3cda248952e5b50c9c0afcf1f9af2d729fef52d9e1631b4939970a2ff

SHA512
d1b103fc83649bce2db2da63fef90a687bf085017af8e4d0d07d949bb2b0afec2843a613c0c45ddbe314cfb48939488dcae9e3df14b3b8553121166c5ff99610

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
282dddad9ab232396260d2818e90c32a

SHA1
9342ad3cd9d09e96a13fa0c8a331200c39bf465b

SHA256
d8c9a9d67b10ac77eb860d45a4ee12bb3943ee20426aaa688dcc203a5dc73d7d

SHA512
3aacbd53e55cbb82df7c5efca2ff6fb83693f8b7a20df2f62b1534392d6febb605a714e177740b7418b5d443afb6cc269fe4515254ca6cc1bb30abd4fd90d031

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6f1d4b0308f43d5947639940258ac02

SHA1
053f8bcf4d065e45e69e961f92777d90570f926c

SHA256
996a2e6b726416c6b46c98d6ee789d9552c4ce2cdeccb3c9da20149f6ebc33e7

SHA512
726104f24564f72442bc6d74b57f364747372fada9984645602638c2f070269ce4d6f687af295f4b7b8e979d88d215d9396ebc33d2c8294ca883b48ce5c000f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45ee94b33b167ca512933000c5f45e42

SHA1
5e10b5c5afb716b09b779a2c4542f2e6823d7bf2

SHA256
4eb4a1311a002bcc53647922a0061aea684960a5296c49a7357a7fb9901e7573

SHA512
ebefa82db9d930459eca3388ba4c7ac43f1f0593648339db9a6d7c65a3b0e7092478b04fffd6143187b5b0615a5ba57c525ea5d116f4a6b6377bbac5157f369f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ff3f85f7e6670a62b41b1b35e7f0daa

SHA1
b4c224b4138b210ffb7e3d598b347ba1c4166404

SHA256
ec9098b30a2258f58bb1fc57c01fa4f6dc89097579bd6b160f2e09b292e278c1

SHA512
0474ae3485536795d57f31cb960cd665175aa3c3c6f0b362446c84cab21c1e15b1929bf0dd4e7449db9d575a8752a7158bcf404a8a5c26531d253a76343ae77e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5f7b98093899b0427ee09eb9ee24fa3

SHA1
8b5b214a92fb6088bc8e8558c9c928d1b331f019

SHA256
4adf1967a847222c70566b2fde5e3080fa816170f3b13d288917c7f700d67737

SHA512
cc0eec4d2ad6a1ab9625d678ce984b72965f8db573d9083654c31e22b3634cc9a8c9faf147e191831236424d356e3e72f740bbd1d53f1ecc1d84d61c4589f525

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc3798d360924bfd0a667d3f1290386a

SHA1
42f4b2adf1c9f9a541508ac7437359f35cfee057

SHA256
fce30ba8a4a79f836835e6841a1427047634849511fd5e383b2785ec134e54a0

SHA512
7cbbec63d3ecf37daa6525690a54a6d695ce2b5941eafefa293f7c967b79ac85b1cb46e07f367bbec01b27ace78836e83cde7dc89a8adc1d7538465ef4663ca4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0d4a7febb99f189abcb8f5e7f5d5202

SHA1
8bf959a68c0169d97efc063d0283f48233365faa

SHA256
ffbd1da2a2fc6e022f69eb1fac9681cd06bfd887e0a5d730650ad06f907302a1

SHA512
1676d1a7428f8ede499885fcefe459cb5b35cc71560e7fdcf708ede456f805c773bd038bd338fb65e95852c5b7e40a11f28ca171f801848f64b5e4594e928c67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05d77e68b227f68762f755f6d7d81c1d

SHA1
f3aa35420574ec1a1f4d560022316afb3268f6fe

SHA256
20fb97f6c21927bce8234740505899800c7309e6f20c38e8d5b69970cfa4bb56

SHA512
4146efb420b3c4b4c6df6dad7beb6e7496402bc0f95e88bd33bccbc89de8f63d1fc63fb6f45dd1ecd37c117f261000f5416836946e60c89ca406f924c774c9ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD05B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD4F1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit