3a1d873b54b00469374ef25179c0c69037657b6f220fdf982701fb2cb4e0bd67

Analysis

max time kernel
140s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 04:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

11d0926e2d933f5b73aaf8423bec8bef_JaffaCakes118.html
Size

12KB
MD5

11d0926e2d933f5b73aaf8423bec8bef
SHA1

5d123289c6d92155430e5ca4bfb7f50362f78aad
SHA256

3a1d873b54b00469374ef25179c0c69037657b6f220fdf982701fb2cb4e0bd67
SHA512

056d2758d6c3cf7fbcbe8e944ce2686a42ead8ce91b3a6b24163ce428ccf62f27ceb60bcc8bcaad9ed30fc8ea931341016251b6d0e1319365da0911b1efe9768
SSDEEP

192:CyiMwrFd8o9xoWSHDCd65aSAVvxywjCVCfgJTV/0wkMz2vbQAjfkolozAFYT:CyiLIv2oa/dxhjAigb/0lMz2TQAjfEA2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf6000000000200000000001066000000010000200000006364d764cefa196a8bee53c4c93e729c6ea715182f8a4b55746f114a69c156f9000000000e800000000200002000000081c32b196ccddd9c22e0b7b5dd477162f27bc73179aaa1955b6b4e8c81be5c589000000065f1c2fd46c736f82af388f5958ed357571c481b117916b7b0f03be30d974f1e825b7374d01e7b94f5703f3e96d2c6cf2d92b9196f16ef417764cca579e18c7d2226a9b07d01bf03b0046d203d3a32636b6cce194d5e9229232575afb122f74e5c88d193729c483ba8a13702982797cd5d82852bdcecc3831a597f5c09a17e21288934bdc0fece542fdceaf25bc18891400000009d138e6615e4affbde20e178786f84abd901ac4ebb2ae1b92885747ce216f172c021f7ea83b75efb1e475c3029b96609a620604ab1a5350e1afa44c541595ee4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3B0763C1-8208-11EF-88C4-7A9F8CACAEA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0b1d0131516db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf600000000020000000000106600000001000020000000500f664d0a20154f541331651623effec5078fb1692dacfcb06c7c1f495c55cd000000000e80000000020000200000002131b44433ea6dbc52582a6e90ee6046a708e836f83ef567056a24a781ab6de920000000ab589e03f3c73eb2813fc2b47c85fd8b1331f51c5d8983689914293e973d39154000000073abf77cca7827e56a946393de69d2ec1c8cf26465eb2800543e8612060b0cec5b6f6a6b47e789351f92295b4faaf231190c03772168265f947de669d01556b2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434177601"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2480	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2480	iexplore.exe
2480	iexplore.exe
484	IEXPLORE.EXE
484	IEXPLORE.EXE
484	IEXPLORE.EXE
484	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 484	2480	iexplore.exe	31
PID 2480 wrote to memory of 484	2480	iexplore.exe	31
PID 2480 wrote to memory of 484	2480	iexplore.exe	31
PID 2480 wrote to memory of 484	2480	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\11d0926e2d933f5b73aaf8423bec8bef_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2480 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9521d9ecd96503a312fcf0d93b0de282

SHA1
952a2ee62d782f36e68c8a1828f186da8c066150

SHA256
f41f00cac102a4a59cc6394ce68c49898301df0187b90e6b24831c0baca4d8e3

SHA512
9bd3e62675391b9dff9f545a42d14977dcad44f58878161196fe659804df26033f02f0b3aa587f95b711a2e847e4dc8859fa582230fe1d405288269131f91e19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7321a9eec76b459bb12ec7915382ccac

SHA1
dbb7530d6ecd6cca9101bd04eece25708624dcbe

SHA256
bfb2cf3fc4e1df5297c8983e8b9b65ff7db5a37e7d39c85bf05dfbbfe53ee097

SHA512
1ee570539840a06dc49266462044606d87d3dbbb3ed70b0095d0fd9d59f6d0ec043e2a55bb266c91814bb940b89c9257a2a4ee2dc0e279e705e73a1584f4106e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab30f098ac9e8a4232f83234506bde81

SHA1
fb278d5bc60c14cf8627008160f6e3b83bbb2b10

SHA256
f728c877d4ab1cced6090cf8a18ed0abe21d70e4c43e551f63e3b58aedac0a9a

SHA512
81b252678d40498381d2dc7c7f158d21d618553891a0cdca497f38e3633b2be14abd7735c08bac56b8e3d9a05cb01cacb04b6fb204fbf94fd60f403a195d3d1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2f5d0e93f4dc5db353fdeca3b651010

SHA1
dc831ec1d679613d2680bf9064199ff6eb23eb27

SHA256
e1f11866af2623a3b8acf00d23cb20c7747fddc3d8a8933d8a8ab6398f7a45d4

SHA512
cc956c886ace53254d17ec9ac8a578e9467dfd8e206c9ba988abe8ab63778d898535863901fb86441978287df476be015103a419ed15c6f46b8c93d3d4f39644

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0097f6852894b0845c16d37af9e1d1a3

SHA1
3275d6c98feed9020a4961a4f9b264423f7f5cec

SHA256
434446193c4da52c406dca78d7c6a13dbb76c4396093c238f041d4f45164b7d2

SHA512
beb2598934e8cafe3e19668e33ac15effdbc417345060a2cc57bf23c9a9df62716f398a50bbedfb76e1902233bbee0276a081859f795d160773c5db3232451d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38714f9eff2c280e9cea8dd519ef4a36

SHA1
87119f17bc9d3eec520d9b2ecef80354d1cd4c9e

SHA256
8d3b07a0c043d4a66433c749babfdd87f51a3dd62e9c5f246d62244c7d353372

SHA512
c2a4ec65c41521bc19d59eff4a8407609c3915b494ceea3eaf0926ccf973366f7c51bd66be7ced1d7def4342442e326f1482360ba0cab0a76893d950cbbd6478

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
858ea638039e48c7c2adae1bcdfc6c50

SHA1
52a6859a2b1c9af45c1efa1f33e1b02000978d6d

SHA256
2c9ece58f54c7b4191b0c99984c23e0504272c4a387ed5426133653d424c2235

SHA512
27481bb34355576f02a09ceafb7882935c5f57872ce302e97088fabdad8002e459d6cbf5bbdbb0a7543c088c3c32a975eed65fb5a27fc4bc77c7ef6d737cdc5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92eae615ed619fe89e5fb263559f18a5

SHA1
c3132c2cbb44102618685b4816ab12d8fe7d3b70

SHA256
ff36a6e4a50971512b6bf20df23c5c8f92b2e433cb009f486204d9949b1cb4e3

SHA512
4e7513601fbf7402605b807d6aa2387a23a1554b561835c76dfbca759d2224b877a2dde9a1619e1817b64d6203b7ad92c830ea07ca2c156e25fede6b8343431f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
804f334bd989b5e364ec69f83b09b8c0

SHA1
282abd29f178ce1bc9ba9adc1f84f1d09af3e2d1

SHA256
1dbbe964ed28e7a0795f026cc220eb17914348746dc83e26b21f14acc133d434

SHA512
5dba71346ff46a7c8e457593b41cd66bafa0cb5dec1ce389ed9138e2bdd86b12d454f0ea27a0babea722666fe238641631b7a0db361a467881d07143738692a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
330d5063f9cd09cf2c36cacd23c8d11e

SHA1
649fc57ea551b15c76964f6211606d3472f51512

SHA256
1f0f75dd0e1a074e89f4a46d55a824e401849253a9014c0eac4b046006d38de4

SHA512
65105a695ca8dec6ef35889b5923e81a60bee1ee2084fb85b021d3d39f0fee37938e0b97ffa5e191218a89441bcfdf78cbe9fe3634634b4d479527ec15313f38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1fe74a79a52ae42b25a0671a031a203a

SHA1
0c142716e2f2b64c094ee2e7e8cf5fea9946f853

SHA256
b275e849dfb7fa0f278ab3b6c624c622f3a6f01ae91343ae61921b1c40155b25

SHA512
6a737f752c2b2756c70cf6e64ce23ca1ee2661f2f59bd796a18553ab9a824dbdd98c1ff41430f8e209fcdef0c0009a74c7f4440fc74fcb5f52981afad07c0e59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6a46fdcf2d06bb6265d369302f7632a

SHA1
f6db1951170dec81e36e587b348509c50f144483

SHA256
ada37b2932ab186f47a0912bc28b84ff8d94122abc88e1a8bf3c34d417803ef3

SHA512
cee2b9574213dd3093410f48512363a479c5d729db572a560e4e0e330b87f093b7f33a2e576644a3cbe101e4a95e4e548cf4b6e5eb25bd04899c93f7800709ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bca4a58ece443503f06413b2939ea0a7

SHA1
4deb4106449ad6fe81e93047eaf835af0cb24809

SHA256
3b30d620a0e8762e8146ecb915a736fd97fd7200c26b944e9af143d60e8a5f82

SHA512
7b3b9554bb5c1b8be275b443aaf2bc0692a17a5a8cbedd0ca707f8a0ab58bbfd70ae160799938e584729d8e4a53b150a4d938f744682c13c9fae9a151ae81581

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9e68aa0c5a25643be1ac5542a1e0a2a

SHA1
312c8a3e5ece787d7baeb175e27ec80f8b81bc3e

SHA256
6a887cd9f421c5c2e17ce1d04f03617d9b200b798473e3739997c92a7cabde35

SHA512
b476d63e185b47477df17cc9af948e33cc3f0d173fe5b74fcb3b914e1fd1b7a90dfdf88411563802d58157112601e722b0cfdee56bd0db4de6964c3faec16e40

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab409.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar45A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit