517bde903f0abfc74adc8b24e497a4927981f97e85fd9ab652c6ec2a428f675b

Analysis

max time kernel
138s
max time network
133s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 04:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11e048e67eaab1f4ddb690cf269c3e7a_JaffaCakes118.html
Size

8KB
MD5

11e048e67eaab1f4ddb690cf269c3e7a
SHA1

3661e4ea660a955ff3ec8e98aef03c2b69b6a8f2
SHA256

517bde903f0abfc74adc8b24e497a4927981f97e85fd9ab652c6ec2a428f675b
SHA512

d73856077033c3d4a24cbf574a95aab2f0ec3aa2cba4ca18b5ff08fb123be963c2929049969a27475871284ae2b38ea84033c1d119c5808fc408204af2f92c19
SSDEEP

192:g1AfR0pu5popM38jYyoiAURXHj7hc7jHhSjLlj+jlxjtaFH3ZBo8yr:NfR0pu5popM33Li3RT7hgHh2Ld6vMpBK

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0BA5A171-820B-11EF-B692-6A8D92A4B8D0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000242a277492d7f43aed986a20b3bce0c00000000020000000000106600000001000020000000861c94e1e101e1f23b1ca1356ec1341dabda6a14885b61d3ab42d255d1fcb67c000000000e8000000002000020000000704dc59408c03818d9d502b9bb751c1ab8228695ed08f09d7d1b8ea4f261e3a29000000036ca88d144f2666e24aeb51770f77116b2ed272dd732b4e62ddc58fb913ffd606c6c98f2088079653d26f01f6e70557a4fc5647767ee69f6a672942fbd3a378abb56c3bef0d3f253be551904acee985b553a47c78f610c5639951237e32025b536eed7dd104af3bdc9e9a2bad47c2a0707b1979fe1d7c9a6a84cc78cddf6d6b95d27d42e0df502abaa2373b990512c2340000000f0dfd2e03c37580bdbdbb99383f8dfbedf7a0eb825ba009a6f48b7f8210c7b0b466078392ad198b835bf88bdab4a5356393ef6b0e8d6919e710e3514ad6e5084	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434178815"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000242a277492d7f43aed986a20b3bce0c0000000002000000000010660000000100002000000039de53ddf058c5d4836d0f876c7cedc9ee33b8e9558f39d8ec51a0dff0dcc975000000000e800000000200002000000006ee74713ecf6c55f130acbf88b8caaa5c29102884bc7cb0fac55b51e067c056200000000a6c3ad878272aefa25807cd9e660379d0da77b1dd5400a07dd7c8dd81bfc144400000002fca987ad7c35ccea435b91a2a4f8553f59da688cf796c634b169afcd3e7df70227cfb744449113c3b3c7301cb200cd01cd72b704a6f34b8108e8e028dd299da	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20c052e01716db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2476	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2476	iexplore.exe
2476	iexplore.exe
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 2404	2476	iexplore.exe	30
PID 2476 wrote to memory of 2404	2476	iexplore.exe	30
PID 2476 wrote to memory of 2404	2476	iexplore.exe	30
PID 2476 wrote to memory of 2404	2476	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\11e048e67eaab1f4ddb690cf269c3e7a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2476 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2bc8d53fb0067d606d3fa23536840c0

SHA1
e35498972d2875b296a50245509b8270591d2363

SHA256
d242a803d075aa630867188135b9476016b138fd2c908352ad56eba9a97f05df

SHA512
bc469a53775bed75b1b766657bbc49b49b14c0c07c213f2cda3ceb50d22cb9cc171fd79610e97333513a3b5ee38a64994f80514deb53762e7476504d2ae5e847

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e165ab271f4f657fe988e90c0d1cdf28

SHA1
a70056c787edb636637e1ec4f9be9bc7bbd29c89

SHA256
3d090a7a469d625ad2ae49379e154ec0fc88821a79d7d747c0f2d8545d40351c

SHA512
fdb179307f6641e080341b4a4ee10614c32d53a25731f394401a97805dba729cb6bc4de3c2ff1a0bfd6d29076cf521057420f76ba9cbd22bb0c0ad49b62108dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1eb4f6ca4bf6154d765589d7295aca32

SHA1
5baf31d6621fdfb6dbea50ab0c58ec5026f9441b

SHA256
6a6e8f0ef3133ec0fd7006e16267914b8630a23152c29da1ba6a1fc374bd1fec

SHA512
059f5a6f2539d4dc8da9b561a1370655c6112db6461504c51f07b57c418c10f71a7d9bfc1466332893cf04191a5d344a6cc28e440dbd69d433d55543482f3ba1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf1e5b8210a1c68ef51fd4f3fff68d41

SHA1
c91428ec0d545f01ee7bbe100b3b1df2641dcd72

SHA256
cc72e79b20823d5baa03c87a4be12994cba4574ebaa64e106b54e21b3a0c77b0

SHA512
03e02948ad0a92b99c775e48fd7824f73c77ee7e4cd86117ff7e22ab6d0bf307b66c5d96bff8e5f02b54ddfc834c658627a9ceb93982312257a663adbff10285

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfba4255a525f58aa96dcc28191ab032

SHA1
ebbd5cd05a3bd062b1a5d821f30fcceac18a968b

SHA256
bafa557ae0ce353746eb133f13a53537af0c518a601f1ec3b3c7991f72803aa0

SHA512
7fb69e36be6684a3d4a6a0f6daa94c63edb6677251e54db30020cba1b87a6b6e5bc7032a736b9d878dc481fe6a1d993641868b85aa8a7957fe8b66cc0078e168

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a3b44fd05c7e6a5f53c7a6004d736e6

SHA1
3c2bce59e234054ec5cc1ab343bc54766c435e57

SHA256
77442a6fcb655cdf0d215c64ec7f9101d3e41a357ae90c14a142441ffea221b0

SHA512
7ddd529ee4d657e8d113182e3a6939c21ef0d7d1295b4986b0b917cdf1f93f6aafd04ff8447ed1cff30cfb406fe8a1cdfe285d789442a0f146b8061ec2ab11be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c8e04f79e0aab6e540e8a6466ce2885

SHA1
5679dfb7904fddf32ee6c34d87c74a8c89a30820

SHA256
c4a2ae8f361f5ed4703e06000625299d58b66cc6ff2deed17d1303308e53dd37

SHA512
c14385cc0d9994db58d2984023cfd7e0229843f71d35e32104e7aa37d42d6680532d888ce93cfac0dc32c5f5aaa546e28229c151663d61614f34dc8cbe7bc1c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bdfbac916f14a729594435031f34b11a

SHA1
2b835035400cb2a9ef1d3107f45ccf50c72c2633

SHA256
709e524fe261b66395e0f4cc44d0f1c463d7f1be9283a8c19249c84945628ce0

SHA512
73729132dca7366da1a80fb145e6305af96fdce75a1c7f83a036929282f7ae923ad56e4f7b9ee3189ed2bf661b96640430eaf6be24b189fc6c793b5963dbb112

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7b7a2bdb037bd0ff3de7064a8ab4800

SHA1
3b85e34b185e1bb48001e43be666e474d62859e3

SHA256
298c7bef3888503add3a87a9168bf7d0dc7a095026ec94e389519e1773b1044d

SHA512
18ebd0ab4e12eadbf788de980a524b035aa62c774f74d8d4083fd92b0d6c41a1decf4fc26c3f9a98ae8b8e5668077b676c4609be35bf4d5380028dd263be5965

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1eb40a4466796ceb37ae0870c33da2db

SHA1
f6ad6b04d9bf3149b863c0bb9099d97605f86ce6

SHA256
f28233a225563ba245df1d775c35569d738ce8d10eceed9a8c9e0ec59698675e

SHA512
09193f1fe06805a757377c0ca939c78942215395596897fd79e5e3d9e615c3d33c86c91be589d22dc12190bc1a71a671d177f86212fbc72fbdf95c28dfcf01fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ec0c4246e9d78a46d9c946e439bd588

SHA1
28c61fb0f3b1a470ef59c0f17b137ef9aa3569af

SHA256
3a7bb39a8a597e627f39f83d26990e7fe33468aac719bd20d2d726a22c67768f

SHA512
2cc033f25b2952a7ae29f62547bca44fd59d9f92d3cf6b1e8a2d24e9834bcb77855e090930cac9c01880be7a39b66d890aac009cb785c92ddc7768745865d55a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b28906cee2b6e0910d98859743901e2

SHA1
04019175fa3cb867c64faa40603d45b1a7b04f8e

SHA256
f135aac62a629e5e3db59d04e882bacf18785b15e6508626a0000b5400f40e3a

SHA512
a44bdb61ba018302c71ad7b67b9a8f3685cd9214baf4c592cc48e7ea0c87e3464b20c4a8b367fd9c6e5b5f3781d33216716a6cfe269bb3d140e0d6d587f97a7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b11b4e9c3ee722cb13e2224acd5630e1

SHA1
f6f10cb79a7fd02a040f660ce756444f136eefdd

SHA256
ef7b32e8846cc8a402e7d9559e4093e932602f6ca5116f5618fb3b2ae1804792

SHA512
bc84008a710a9f0761b1e38dc739342d1d467156a9dd3f9315a5a9be017c4e17511cc9f74a91c85408258be553b5a433e39566008a36247b3683ec0f1490934a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4c95252f455e304d21e3ca47dd77a6c

SHA1
7189daab5e7aa1d584344f08dd724009c23e2fe5

SHA256
7087d1a93da25b3d8375d6fff43df38e6324c21a829351cae5bf015fc6a51d66

SHA512
33f6d124902d7c3ca4a0f8dd6cf0e75d65386a7c4d6ad5399b0f1af9856d09f9245da6524ad24d64e9d8be019bc261703e9841507be2e2aa7588c1c76abe271a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e43ddad4650b5b6ecfae07fae7b47ac

SHA1
526d943ee52560167db84b2b31bb080d4bd1f2af

SHA256
e9d249fe623c36c8caef87fb3f92cdf11df53848259a3a77273cf24dc0af9afd

SHA512
b1f96bb941d670a08c8f096afec0d85e3518478fc2912274d2c7e67925f2580e5ef154f241c20eaa8859ba4f773d6bb4bec4b3feca27b7b89c9692814367b297

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30b934fa57f39a137364e1d92bb5bcbe

SHA1
0b93f57abd772313901c02527261540e00661873

SHA256
a43759acdc3771e123aed5894f81c862049a2cc5d5aed7c1c0fb8aacafdcf5f4

SHA512
7514dc0eebc9761a00abb9951294d20605a88ca61603c9f57b7b7a4f8a3ecd4faf984d6aa098932aa23dde76eb8ab3501e02464bd747f68ae07bb74d2653e71f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD710.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD7A2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit