62832c61fc535a07bb2c0d6c7a92780e6a780837df55f2e25c806d134408297e

Analysis

max time kernel
140s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 08:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12846de3919d871e3ca80d2b5cb0c03f_JaffaCakes118.html
Size

7KB
MD5

12846de3919d871e3ca80d2b5cb0c03f
SHA1

9bb255e59a4a0f9bf231a5bd3cd0f800c612e18f
SHA256

62832c61fc535a07bb2c0d6c7a92780e6a780837df55f2e25c806d134408297e
SHA512

f1624ffc53368d0702ad37f35a4f5ed00c3f391d3d3de85de003a083b87cfea3ead0c5011458669f16313698314ba344e1bed163a891978a991db38f00548fb2
SSDEEP

96:SIniwv0HXt08IMnoXKjl63GL4X9U7tIm6DTIBDD4HsfuyxCDeD4XKQrgFf1Gj2w8:SIniwvePfo6olKGmNvfu046uw1aPve3

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000146c65b8f6512407525cadc756ba609f0103375b301673bb475e288388d2205b000000000e8000000002000020000000b13757954c9f480f5b2970b0b96fcb9422d7f5be36a70dc1952eacef75b6350520000000c8a1d772543166e4a2ad363c06202c43864ac3afd21c49b6ca800c012819f20d40000000991fa86292ce4b9107bd41fbdee59b50ff1eb43efb8c777486e3b6d4a77648ab63d7883d9ac121482e2c23763f537c34567b117cf96eb12576e47c5b615a39b9	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50cd28ab3416db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434191140"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BD3957D1-8227-11EF-87F4-7694D31B45CA} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b0000000002000000000010660000000100002000000097f84adc08d5ed11fc8fa099f934ba0dc3cde0684dcaf82cc46665b75e475b60000000000e8000000002000020000000f0b7e953164a3e5e709e91226765d58465728f7d5129974cd34da13596b30965900000006f2b1a42b50a84fb5b4154fcc4a8f594bb2bf765c372ef8fe0303679c6d64c57b3019ec86da5e135b34e3a986778dd957ffa4c1c4ac4f064779df9d1b66041aff6e4daeedfc2b3162ac9591243d64efd40cfd9ab32ab0346ad010c593771a5dc6fdd5f76517c65308cbbce80fce5524001db577da35384122e769769fc681dea02a97ac06cee4d5c415faf9b0e39db49400000001fb48a9c22358e2287348435a15a4f7081e6501dc456e50574feb720d8ae887c5f353d37f4025352e44e3a9a33ce374abdc185f2738bea82494fa18425fe5497	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2776	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2776	iexplore.exe
2776	iexplore.exe
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2832	2776	iexplore.exe	30
PID 2776 wrote to memory of 2832	2776	iexplore.exe	30
PID 2776 wrote to memory of 2832	2776	iexplore.exe	30
PID 2776 wrote to memory of 2832	2776	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\12846de3919d871e3ca80d2b5cb0c03f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2776 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
319bb1f87fb238c741fc10fe9025c661

SHA1
f6e943d4df522b7c732cef79ebbf0aced8418a3a

SHA256
74d158dfbd9a69f514906483a3c0dc020e67f1354d93bc949ac3f352abd3717f

SHA512
78aa5a1b20dcb2f47ee971ef3e2fb1e1e1cdc0ef408559ac7cfa9aafe7b42625355992b98b7805d84b9eb6ed8704e6810c50b0dd110b074b74a564109c4d45e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ba91bcea2e4215906474c8db59a50e3

SHA1
e19d102fd065ce87c05b358ef706f2b564b37b80

SHA256
23429e90070929118638b924efb2180d09094b0a6275e06e4cdeceab59ab8fe8

SHA512
dbe36d6a336cdcb189931500f07d6349c9db77132adeea4d967a949a55a43dfa1acec5f56887cc4b7c88d70099370e3249ca65017bc16c0adb2284630279fc59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dde48a64bf2b1bafcfa05b7bec2e8af5

SHA1
b859a833afa81417d5c62846f81a8b30f50246d9

SHA256
e044f006fa050b9b3d24b4acb978ab31986dd382f1170e5d709c058501b5b239

SHA512
393d1454d33aa055c718c08d18aa8e784023858d161e06241cd87968b31e8d4c0403177883d36ec735262d5f92de5200b43ad92aef5ae4a2484239891dfa966d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99a770aae42d7afebe5045991ebe1cc9

SHA1
18ca3de0ffcad249b948ceb6371fc9675f17834b

SHA256
13356516496a0333e8326f41e6620872d7b5ca1a56d1b3845f103c453ea7a161

SHA512
5f76d7316d56eed061d002aee687403a114008a84aa65f7c623a8174aee3f685cd04703d52398543ce0c904d62f20f8003e63128018ae2cf7fe6e70b0d9d97c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
578a66a3837a7e87bbc9b732fa37427e

SHA1
6d2957d49a66c6f75844da3af11529518c9988e3

SHA256
62d8b1493e224f74572c937bdcb40922a97d438577cfc1c1c191180cc244b49d

SHA512
0a91d13781bc1bb52ac757e3cd9253fbe810f4eb35e8ee94d698a645c03a64ee7b4a4ede5bb521ee67f3a0f7aef467cdf7e2fc2debb5c648062188980242710e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6abbf68697a0dca2804391e6d8ce2eb5

SHA1
821ba770b349eaf3288f75ccf513effe84b4a121

SHA256
0e23deffd1d5b3a27be62afb5cdfdc93f2993979015314a424a6dca952b75c59

SHA512
848db2ce9c137d5fa802e21a4d68369962ecafdef4d5bac3d9b1f2aefae599d23b45fa3790076c6b5d3ebcff8879e3b64e7fc56d7f6130cfe0df69c5bcc30ae8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb8911201e17f3f6231229e0ea3db1c9

SHA1
0c6b387fbd1f626c5f0a9e7618ed088f162f656e

SHA256
b5fbf21cd8fd0d7c0fdbddb5cc640bc88c54f3e354dddeb57b7c52d6e7a02aca

SHA512
6c13a55851a7dbf48c73a0ccbdbdc83b63315c2c0dfe058fd5273f48a9c2d5c10a945cadb86a89f0648f45fa825aa7984a842c4e5a762c22c0b0843651f8aa3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
915b5d9571cc8dda8d40e04aa637bfa7

SHA1
1c45114fc26765b1a34493c9ddaa8819a90fde24

SHA256
266abfe58f133fce230819ef3499432f38c6fd131d0778386dbfe0c93f25f633

SHA512
7131b65ea9f302ce047d2a51d18c268dc7e6c7cf0eee6f2d070df647c00b3fd829217778c082680248c88841c1c1d3ad4949e29e6f45f48d631ad0be027586e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7cc03de1903a0b250bdcaa71c7e59c6e

SHA1
21978264c48fac919f4f0277016da2d4c5f295f7

SHA256
37550c14b8ea706c4ab00af16688196f9f6ab3a9437468fa5e0d5ed02fd9af1b

SHA512
0f67fb33f558fce15cabe21f0cdb6e36e52c7eb39aab6ce02e0516c2cccb223f3de707a306010484e82bf8845f1352124a0dbd2df0fe94834c5d92303867988b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
684284f26345803044eb799e228bf111

SHA1
e9c557d297b641e822367fb8eb91612f9d00e19a

SHA256
d6a5a64ebea5004b6fc0d092ba7f3f82de45fbcb9a645158c178b74808509f7f

SHA512
45716503b0bc88f0c2f0180707a8b6f7c550584602898fac7c266da57a28170d21a465638bc6276d7d899526a5c619efe3219ae3d05cf2ede28c33af6bf83171

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7e34d2f0e83d8586b2d7539ecf621a6

SHA1
8704185206f4f326394d467794d5b3028d15227e

SHA256
54ff63336aa56d23ad9c071dbd069b7d6ecd16a1388a55be42e056d4dfd3392e

SHA512
852f1204fd6f97a6f69798ef96b373a43c3519d241d3f9d9752d1588562f9ad44b10e81d7a23261d9211a16d1492f7aa361451ffb6b9d4bda5fa233882bfee13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
189d21786be89f8732de90370b939819

SHA1
78323d26188e4d814dcbc9f8fee79c8b5b47fe1b

SHA256
8545d8472965dbeed2f3901f0fe06c402b0c981f5a1bb813c9173062f0f2c284

SHA512
71ce537b6e6fb81aa0c03e4fcd9b85d3a176e496570111bb370349e83c095a62aad029eacad4e138b4241237142eb55af5697d1b7bdab433d7b4aaef295950d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db193afe12d5bece25792a556eb76ce2

SHA1
a1fcf9de62f1c7a622aaab63b52f5077c8b7fc4c

SHA256
72b48fe52619250626e32a085118946b99b673ef96e6d3833af902aa55741152

SHA512
03d7b04a28b257691c859d91effba503f0db0a1f5c41c3e9e43f9cf6743eace2e578d21bdd39d6241cd978a37b3e589922ca5fbc432e3c1bca28006042a99ba7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c5872a02b528efa99d6ddca957c134b4

SHA1
ffa005375790613d3ffbea35c99d4612747b2deb

SHA256
9da8c36c2bacea18df8903f7d33260297f7ed6c31bf00410cd1fd2dff2d0db29

SHA512
3f83061601cd1043ed16f61c2eb780a219ff24545cc82231f9fdf1ebb7f55ebeddc8361a48a15c72e4d3f928dc9958212cbbbdf5e270f8ed30ab5c75e9daf09c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9dd7c36024ef78835fb9185cd29e9d8

SHA1
59d97d14188b6e0fb316116ecd3dccc2437d59ef

SHA256
03c86aada260f381a1d649424085dc6f71d4a3537b1e4a675e997bf5b5149293

SHA512
c15d14afe4bd95d941df96db0cd00880ae3336c695e5c87def341a8b7681abb4d0f610349df449f1f6c1e48ed04147c0ef2f1fe3a375ecb91562c14bb3e314cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f590706369179220da321b71de69ab1c

SHA1
c32d409d29f9af6fd2775a848d1828de7f6a6f92

SHA256
644606ab4018155598febbec06a53b1e40d1ebf8edfbf7e0c9d944d1c20a5efd

SHA512
728f1660937733dc7170dea6ded5e443d8d63204aa565d1f07eb73b4b9bb778b699c9fd368a41c9eab461edfa9b02bbc928f41b3159ec2d1cf8908f7d3ec096d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab476D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar484C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit