62e871bb880c4a64b7d7f825c6b3d66a552dd9d3adcd3b36f1569f1a67bbcd47

Analysis

max time kernel
141s
max time network
142s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 08:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

129589dc2ce0275cb9f1f6ee4460c020_JaffaCakes118.html
Size

301KB
MD5

129589dc2ce0275cb9f1f6ee4460c020
SHA1

642c6c749bd5ca168b5737113753fabcf151fc7c
SHA256

62e871bb880c4a64b7d7f825c6b3d66a552dd9d3adcd3b36f1569f1a67bbcd47
SHA512

7a5f09ee3452aaaebe0bf22fbc515ac22749b60a1a0e2c817803cab005b724b281f32e2cb4b277cb4b43e4a9e2f89b083de6400cc2edc3ea2f237c37a23bb4b9
SSDEEP

6144:MkQfQfQfQfQfQfQfQfQfQfQfQfQfQfQfj:+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40edc0963716db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434192435"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C09A84A1-822A-11EF-A3CD-E6140BA5C80C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007107e19e7116564a8f1002334573043500000000020000000000106600000001000020000000d1d9567298f6db066aa10dccaa0aa30890ec509232606c0734766106445a629a000000000e8000000002000020000000a8dfe816ed82b825ec44802590c352bd35a0a782c90440dc1393ac8ba56f7026200000008433eef8abeca145397baf6d3621e4efa9d01dae27dcd8d4bf79dbc068e1f64c40000000ac24ad80a133ab4128bc8dd34dfd9ae4c81bf3195207e766884bd7ceb621d07006eb0d190c9a083a937cab0699209b179d4e0dbac75beeaa27bc9ae5fe06b96e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007107e19e7116564a8f100233457304350000000002000000000010660000000100002000000061fa7f850baef0d2fbacd8a9d1b9b9096075cbdfddd97dfb81526721d0472e1e000000000e8000000002000020000000213c53cf7c14dabb30ed9b3b4660607d093443d16d0ba14cea05727d36b5a14890000000ec999b692c65c680a1c43f0817777c85543555af1a7aa058ea89632a268eee4b9a672e1d7eda5df659643ee2b0315408d06bc2fb9a04310493994511845f07da6f090c5b640d33b0b81e63ce9732ad557cc97d759cbd24e18a6fe14241eeeed3323079dd91edb8b16a215abb81f00e7022a1365ff72c31cb1cfdb16a27fca7da71036cca050d6d31bf90d9b6e319224340000000b1024bc4924c0a4d827666fc7c9a6ff0e92301f686e093adc87b90ef72488c6d4785faf44a74aa8b5670517d1a5535627ba926853fc9cf0f85194db26a0395ea	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2720	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2720	iexplore.exe
2720	iexplore.exe
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE
3064	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 3064	2720	iexplore.exe	30
PID 2720 wrote to memory of 3064	2720	iexplore.exe	30
PID 2720 wrote to memory of 3064	2720	iexplore.exe	30
PID 2720 wrote to memory of 3064	2720	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\129589dc2ce0275cb9f1f6ee4460c020_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2720 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
4d7bd6cffc323fa9821f75699fedacbc

SHA1
187e2bebb1731d282864eb5552451b30b4a903c6

SHA256
9ebf4c17762e2775c9105402131eab6634a0a093945e61e02cb17812e10145b9

SHA512
6c301b90b0a21f6d99629bb7684a2445c3e163500263c0510192499caed0cd6d14b4762e9462684453663c82e2cdf31378190dc3149b70d5e534dbc93561a6c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aac1d90c233c7dc8271f3013d311060f

SHA1
9f8c14d59133a3781305066d185a7c641e8de60e

SHA256
5108edcf309867870c4198742fc92911ac29a1c7850a32d6c67ee747aaf22f3e

SHA512
11e613349a123562337c71ca6c7dc62fec732f1dea7ca459d301e74e0d1f95b99c22bb181e1ea26fb3826eff14ee853d2da260139e6650badf15b1b3eb216a9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43983d878c0b966afe44199b54ca91fe

SHA1
7674ec53e39035322084c64c59499fdfc9678342

SHA256
f7c0a485c0b382b7fb2c30ef6cc8f6b9adcdb7e736d74688245b8e38af1f6c44

SHA512
8fedba820aeabfc81287ab7054380c52f348916237ebe4c59d7fbbe06be61299e1bd796015d8243ffe555c8106d65f06ac5d3678147b8524da4d3cfd27a2e8ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09bf64a4f5c53bc0859d0cb5721851cc

SHA1
e5a45b225fadb100a1c7e24e50426cf688108c43

SHA256
850c58d1299ac3abb56dc698cbea4d0afa618931acc026ef532d7911b2e2ff45

SHA512
e469dad63a30c94ff2a65ffba4339670c3f4b96f569987dab23152e0f0d04f0535d12fc2faad4b826c65ca545f2ee2d44b2c099111c53d22f806e65edbc73ec1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff74a5e687ccf0e7ca3ff467128c36da

SHA1
2f44fda24c5762aed0859950580c0a51ec9352cd

SHA256
832ec9c5b2fd7e9fd1da7bb1f59281f193eee2a1e050f98e7e125e726858b4a9

SHA512
87aa8fab0d18bec188c735cabca6dc6c60a4c04fb167a46552dac95bd3bf824490d2d04b607fc78dc8dfa58c4786369f5ce42b1a4b2bf446b7a6043a087e5547

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
02431e1585d0ba0629f3b0efe8b196d7

SHA1
8526b5423fa29f023dcc0c2c21dbb9ab4e4ed3ee

SHA256
44054d7394de1f9fc1bd7efeee944a5b5ed5370a10f6ad4f96dbc0bec968505b

SHA512
e3ff5644089af4611116ccc7dbc87da8f673cc889c7f71ba83d23e9cde96974a41521bf43ae03229144903344ed9b5815ca7c8039782fe8b0b7b035cf2f7e770

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a6f9620141fd147ca7acbca8af10171d

SHA1
d5a85de03efa4ec5b75a447a86f8fda5091ecc74

SHA256
a640723b4fc1df0a904bcb41c9c01a9f51911562ce750e136b481791a4bf33a7

SHA512
7108e8fdc7f9c686ee99f709e45345c5f00af0b4c1b387769b02128582c82543f03c3e06c231d9bb3891c9863a668a8119e9ee039b16f4a7f82c7945392e61c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b16d22faf353448e6943e3ec0089bf8a

SHA1
0eacb4812bf8e8735b7c5f839efe57adecff8e54

SHA256
053895f7013f4e84c246db337572da7cb192eb85a7a5dd0bf5565ea90b5c76be

SHA512
b1ce60e90315f306414c3894a2439e941b142dcd5bdd93f3b0d81389c0ee7a33c1db5c2bfdb607842bc5ce2b4b1bf51d47c168fb6b89b8d468f14a0407a6c274

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69ab1f1fa958e7e06bd356958d5c669d

SHA1
5ce1494d2493e9c80570e877075168211cb03364

SHA256
b880c1015bbb85ccfee073f668fe1a78d89ac87dcd8963c68f68a3a8ae3c9d97

SHA512
d0a2ab4345659bb91db0f018699589dfa1b24df514a7d43df065fcef3a840f4943b8d34b145e767019aa682141f5db632f6b0aa3f07f86327bab5b266f004e92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84fd09ea9b6be6b1da8ef93896080c3b

SHA1
c9a7832611db35ce7aaed5eeeec363805b1c9ed3

SHA256
7bb96de8fad035e28a9fa735112e87254524baaebc2891b0cc8ed39d6a9de25b

SHA512
78b967c2a620ec709352d025ee32969b8e87a9fefb6c8b392525f8af907dd5d5872c1bf47bf6b8a1d984589528d91c31bbae7c016bd81ce7708d9cc2391d5e06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30f6c1ae95eed10c1161df27e709c395

SHA1
e6c26645d60780892f502b66feac27dd37ae0637

SHA256
a834ec2fbf519c88b9e8a79069ba6b7b18b8d638d993e11c56e3f758ff6fbcee

SHA512
62fdd5dd7b582bf8b545f97c24dc669e8ed70a318896644434ee45c3d129802fc30b4fd8f6557b47d29ba24c3b98614bf8b067c2935e3ef608293ce9499e71c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
79ce82185d1542374e5d77002f82d5e8

SHA1
94e576758181f7ee7c421d14cffaf2f0d0709a23

SHA256
f08c7f32245ec4c7b8873c8eaef509e7b436f379ff80771cedbac28617f7c47b

SHA512
24c29a2738d54d6655d1efb66e61847c57bf5f21e85fc435301c5cc5b3923403f678e58bc2da1ae2c351f8a28314d3284b29a3c41195aafe8e3b105caa18601c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab931C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar931F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit