38705cf347bba4a3a786de01333d22b271c90eb0f47f96af6942e05bbf82a4aa

Analysis

max time kernel
136s
max time network
130s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 17:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0fccf15cde8077abfdc2fa4942803430_JaffaCakes118.html
Size

71KB
MD5

0fccf15cde8077abfdc2fa4942803430
SHA1

d5549904759ba077de7d16016610fbf6ef4fe678
SHA256

38705cf347bba4a3a786de01333d22b271c90eb0f47f96af6942e05bbf82a4aa
SHA512

e5b5b8359af8abc0f95d40cfb1c2b34fd547f6988a361044c873c6ca86c0b4de30dd099a91267c3229e66568e3f5e82b399c4b9b536c1bd7fe039785097559d5
SSDEEP

1536:Of/yMViK8bjeA6FOqFn3EKNh/49K627XohYdE04XzucTAmydd+9wu1R:qyMVFejR6UqREVwxohYd94XicT9ydd+P

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F7C8FB31-81AA-11EF-AC25-4298DBAE743E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434137547"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000002e07b67df56fd12c0c060d88cb0fb5a5cec41bb0679db5866d35a70a7c394d60000000000e8000000002000020000000ba25d07d3e14fdf2b6bdef7a4f84e941235f9ad01d09488e8e77488778b0546c20000000f18b2a8c4bb016ad62c180e28f1457b74e431499aa61a60cd5170e4a827be91740000000981d269ca74269dd36fb9a29a74d7889d080cf7586cd778f54d77a81b2e66a56142064e66edf970a48347b59f61b1e082927bee5d08e02feff11bf519a99b76e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 407b9bdbb715db01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000000e8537b471231033c70c47720af759bee1e81da3ea9715685ced85b51f1805b3000000000e80000000020000200000001c72199125b3c1c0ea48eff81da84469cb073e26adea5d304d7d04e26cf584ed900000009542991ed55af2863fbd5f51b505c3f5f2f41e8e5443094509ee0edece8afd39429cb5f5e4efe4ab869ef75867570eebebe415902713bbd69666ce3595f7deed99bbfaebd8d9a17825e3c5adc568678bc0beda6075c5bc5277ab577784a1e0251b0fb627f410f1b137161318f04f456393b7d2cff495a36b6112ae554b6c4425c10c93ee5bfde4021a97bc34d8c7f4ac40000000b00bbd694b026efad9de3eb90088ceee85b02a6ca32691b813fbfed647fd26d9e1f8903420523cc0666da862fbf5f76501d354ddb907529ac545c7f6df958040	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2604	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2604	iexplore.exe
2604	iexplore.exe
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE
2204	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 2204	2604	iexplore.exe	29
PID 2604 wrote to memory of 2204	2604	iexplore.exe	29
PID 2604 wrote to memory of 2204	2604	iexplore.exe	29
PID 2604 wrote to memory of 2204	2604	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0fccf15cde8077abfdc2fa4942803430_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2604 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
32b4a62bd0e4888eca8363f4bcfcf3c9

SHA1
ce4fedfbc0e54a9a06cc3a706dde42352e0b576c

SHA256
4295904f1c92785d714199e5459552d6d11316df9fe44282e72672dc63cf91f6

SHA512
fdbea9d2d0955465fe9ac97b8bdcafe389b2cf5d29722788ee87d649d36e31c6ea8ad78acc064697221e29f800a2e0e149ffa11cea97905ea5a76461eec7a810

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5191905e15107ea561f33b775ca1f3c1

SHA1
b7240eb6de2528762549219a64f5da4d0480e45f

SHA256
800a9d00b74ef65c6d76e599f04866f51bd4ba58f541b348739ca1bed816af2b

SHA512
259e0fef01cd5a01b15a2874c459e5458baf7824abb9c3853ef624ccca22d062ae668b7701c43adba27c998e8028e59c00fb2a6618ce9e0e2c2c4225ef7e1929

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e33dcf5dbd6e0ce51b4b9d81124246ef

SHA1
7bfdeac0cca1dd303c6984f214896f9660a71459

SHA256
804ebacbcee29ea26ba8da95c7fa6772740f53e667767fc731674fa73282622e

SHA512
f08145243bd66444c68fd78d1d5861de69bac1a7b3ca175ffca5f214a932bc0f5e5445b8caa543de09c189014823975f2352d61a51a132717b9d69bb10412f1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14f963634abffa58daa2e57c84b53e8c

SHA1
eb0a7c81495f43b37fdaf8a97fcc0e0ebaad77b1

SHA256
ea073f6ef645e2682e6820fbe1b1f5b9ac2280cc2e299699262f0a16e9f5f825

SHA512
a72857b852311fe7ea7db4518dbc5c04859e034aca3327468f9ec98be2c8414415bbb572febc89c70742f8a706f754d75a5d85f01754ce1d96b3beaaedc947a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5cf9c23ca287bb6391563a208f1be04

SHA1
6996794abb6e1fe6a340082a26668d2d9d4008ca

SHA256
a71125a45255d38f5088ee095945e4a6862d584f0456aedc255fd348a1677211

SHA512
ff6b37ee5537044d877b5c0ec90e5ccdebe2fd9d2bd4495be57eb6abb10e7ec4478c0a236d3c275cb2a547527d756ab4f85ecb4ac7c29efe71f2ceea9d67499b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d003cbc24e8939cf0e77c3b3e25569d3

SHA1
06d8205d0fbf9c8324a201e4ed10208ec81066d2

SHA256
4c6a38793c0b3ee92acb40b68f839f274a271ccdec0ba29e4ffb30848afb1a73

SHA512
312f5d2d6475467c3d0191290f25b7214529a631cff567f604957a98d7e69d2b08e95e8f970d38e9f3ff598ea216c46b20bda0d6ada2a19dbdc6b271c21bf42d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd46473dede72a47d4d97423514a7b48

SHA1
a9eb5583f5a0f2918582061178abc86df148f833

SHA256
2a6c33442e104a79590228d03aa9635895695e71df4b2e8881189a83af806e6e

SHA512
684a37c25310abdef3a4a0aa058fb103637516b2ea688a7c4847a9220fe080d3fff340457d9aa63b73acceef30378c5c248afe52b70dbebda66569cf3459d108

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fdd42eda85f74ba3545a68bbac2da279

SHA1
863876cea3b6af95630e053e04cbb3d23bda268f

SHA256
bc73767d039a108c0aa33bee4d97badf99f72aa6613397aca58f1d444b230e2d

SHA512
3402abc04aae93829b0e6fb43edfa0f7b1b1ae56ad18864bcc77018d8ba553a2128e80c69f7cc45d2206b37f9c7ebfcc4fe314a929c20b6e804b1515c4ae9c76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84729688a3a4974fb4650d8e476e6205

SHA1
3365c7008a9e28aa357b66ea88b32047cfdcc43e

SHA256
9ebede15a618eaf8f1be416335c20dd739ffbe09c09c435e297c73e3319f784b

SHA512
d9569e0ac81d89d9707d000049197a1ae0d684071edb99371cfb65234dc8a55c91f32d00da3ea6c1914a9121d59b62ec0c0ccb1d3069d185b88c12e0dc3db500

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30be4a2a0cdb7f8f4cd6b2b5e2c6c688

SHA1
ad0ae6e9411ef57b222d8b5cba44575811298308

SHA256
9bf028750b6e30d991253d79ff704bc50bbedd9b29c6a492e89d5631fa45f5a8

SHA512
c656ffa21c8920149ed5afe41b17f700c205f6eeb90b21cde89b30d8ab93568a0114d19d19efb53917d627b02e17a3699d7e55adcb3f61a24b7062f0431d1c26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10b513da90b6c3e1aaa42b5a65aca6b0

SHA1
cc570bd6f202f211433779acfe16a5fe50699e60

SHA256
da2581564342b8342e19ff5d1624a2046a96e74326fd74a832f4077d27c910b0

SHA512
8b7ef7b83dd700392f67f27a4d35e193ec9559566b98a2ba282963c27dd1624c62244be7282c206f2aa01672b73aeac09c3ac74813c5d2d9f49a72a709637c7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
abcb8139b91ab05464a4c621a61435aa

SHA1
eaa1caeff4aaf8df774453db8c12970feb1031a0

SHA256
418ca2f5713880b76264683366d7ad87879fe6a93db6c6f5f300f24f03fce725

SHA512
d09342838d00e8ebc751592e3866edf9adb914ea14038f989c892a11007cfda3cb842111b617e985e50daae8b1eeea1fb3d4b8b2b9d3a45692701644322dff3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5047541ab7e75ddca244009fb975c6d3

SHA1
75f9e4182bc6b26b977b69cd442a2e8a781af0ef

SHA256
8b2a59117aaf67e65db00d2a32d25ca5ae5b1f221f8cccc42f8d521a8e4fbd4c

SHA512
0bf13755a0ad4d4ab820d46fff3506f9668f54f967ad665d240df12d0f74fec150ec6a768ae90f79dd69a0c018387e41b693806c4e719fae855e882b1947b1a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
cda59406b96b246ad4410b8bd3fca08d

SHA1
35e6d3b48a3420389d31cf643247e424afa905ea

SHA256
064827b7b946e449bae1cc5e4a05ead910f898d4cc8e62b4a56e57cd2e9960d8

SHA512
b0fc20f44602f0c633bc3750502cc24fcd5465cac858e3cd25eadc9a44e1185a5f54d57737dddc5b86af0fdd508a866794fa337fca40088ca782d0b8c34f31e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5582.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar55E2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit