8b31b575089dc01597ba7d16330ff4ef89519f2f0e6dafabed7ced80aeb71216

Analysis

max time kernel
137s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 09:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

12c7ef38fda01229a8dc89ffb20e6963_JaffaCakes118.html
Size

138KB
MD5

12c7ef38fda01229a8dc89ffb20e6963
SHA1

a92fa77e09dcc51070da022f57d4c7151228c746
SHA256

8b31b575089dc01597ba7d16330ff4ef89519f2f0e6dafabed7ced80aeb71216
SHA512

96de14ee782d55426dff8a14145da04cb9f65202e470a969f870f0cfd22d24a591fca935690173b907b31834e0d8c80f44f6454dfd816e515e8396de2cf94576
SSDEEP

1536:SZDeF22aQQYSAqCSIXzl9yLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09wd:SZEXDyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6044f8614016db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4DD5A9F1-8233-11EF-991F-EE9D5ADBD8E3} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf600000000020000000000106600000001000020000000de4c2b56c3f8371e5aa0eca47d4ee50c3236ec44221a11d13b24171583202684000000000e80000000020000200000009519d750d2a4c7b481b0e54bf5f2f2283ad938b6fb6551db03c65badb191615b200000001682948d96555f73a25a2c73584a53e264ea3301c4d4ddbb77b2c8fc289f095940000000f2a0f489352020f4a6e1ae002d8a69090d0961a077932c0e94d04d19d53c5872dffc318339b1767c72ad2a37f8b4750efc93df6921ba368fbc32a394077da365	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a7e3310a2b0e6e498bd88e48ec67abf600000000020000000000106600000001000020000000d24a6da0d3f568e92733886215bfe566e039dd12349980fbe645847d955d58ff000000000e800000000200002000000082b6f14306c64e88f49cbaf87668fae53818778d56db2e566e4c084398ecb55d9000000022b4d17d452170bec8eea97c583067b73944dc752b87ab4f4064bc12921f53c652c85995e8644dc6a96bee1e42e20e180ed24cd78f8e48dab54ee624df656369fb43fc10c32d821169c073b4a20e9abe7633cfbedd39caae514b6e033805180f51077ad388f59b36249921462548083da78f14698ab0d845b0a135d393085f9911892823991e4db9cc03e73245780f0f40000000907008122d2193dfc204e79332b028daa0530f802e2ad20bd152ccf1d3a20409e1d92d079b94119e18a5a33c9625f504b7c326ec529c452577fae7893cd5d0d4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434196104"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2468	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2468	iexplore.exe
2468	iexplore.exe
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE
2860	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 2860	2468	iexplore.exe	30
PID 2468 wrote to memory of 2860	2468	iexplore.exe	30
PID 2468 wrote to memory of 2860	2468	iexplore.exe	30
PID 2468 wrote to memory of 2860	2468	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\12c7ef38fda01229a8dc89ffb20e6963_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2468 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f633ce16422fc6423a4b68bdefa6a5a

SHA1
59bf1c9406433767e7615a6be2c7e59a43dd0265

SHA256
0fcab485595ca91c37ff9a9fddeb28733fc0322b998a1555908d8ad55b6f6586

SHA512
c29b3d77e1eb11d28ddc98a56c6492c65a69aa5e4c430ca3cd7ce9ad956e0e66acf60387a8d2525ac5510a2a3ede1cac9394138895318b74e9b1c5c85d2a6427

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a952d8a01073fd1f4a834f828b02382

SHA1
38407a89c71be5d03c882ee3e5c5879714a984f4

SHA256
954d7c97275609bcc3a8e32174ac80fe3482bcf0c6ee9438d22af7848fcef650

SHA512
cc74c77928082a008dcad584e86f1e796d8a0f39c4154b3be187055523a0ed7801a8a1d65b4b3f44b8a4818e30d9320eb98cd61a93b99a745f56ebb090a791b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de48379a392689029a7428fdbd3c6fd7

SHA1
7637200c2a1c5c955b1cdfa5515171122162a5ce

SHA256
a878a2996d1a8512e307f2934d15e2bbe5723b9f2225a8f9acb59013195e16eb

SHA512
1542b65c064cccfa6da7c331dbdabc67f02ec33025540c8029bcf36557e8b6cd151a8431d536895d1753f29637fc27643f26e7719e64086dc029059b1f8af1ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39b9f452751f3afe000ab671b02efa26

SHA1
3379ab7201d03da4a4b9903c48642ac227f833b1

SHA256
a581d9a32a4ddec7fb5c786040cad0f5d2931943a7e60ac4970b5c32f767e923

SHA512
52afbbebdc71e94ebe30cf629096ba80ef66c386ebe17ef8b81b77e93d2ab5497804928fda52aed9eaff4ac518e1c27644050a248ffa3bafddc783ca3d48843d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3036bb9928e797add67d62383f02cc51

SHA1
30fd28cb3020fdaf80e7d7fd932277cfcd86d6c6

SHA256
8af322070211430a45f8f061b5fd88856d910665e471cd4c33f84576bc0e2981

SHA512
0d1ef05f6d1e111586085f33682dbeb86d37b1e5303623ac6f9237a5658a9e4473017c4e9c58a6a3403ae2bbfa34a4466a196b8aa43b1d5757164e778dd585ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1cd6e2f1c405509c884c5b7e3340687

SHA1
4d4c109c9807a9a0295500720e454aa265b8d366

SHA256
7f6137c45d54b62b30ef0bf67556379e4b023fc1c7970686e5ee8400ed968398

SHA512
cfeeedf8d2171fe983bd10f3ef393fb8eee215ec182efe86d7cbe4d7e7d118246e26a0bc3f3a6b9b9dd7cd90946f00577baa459a5e7d2bfe743c80df107368c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb614c67d18128a3be54fc29588926c1

SHA1
fc20d33a5a1d051b5552ec574fed6a113500f987

SHA256
e0e4491d4e81e2af464be3ea1e02dfc44c8bf978fe3c22df03e7dc5fd58dfca4

SHA512
457364a01af7a32fce5f2c9ef68ad606af03132c0e344e6d9fd039c50d823ad03969d02b2e7cd86438018e6d753d8fd6fcb8953a646c6b5257403d5ec78f84f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07aa00d196e231da3079d7bdcf2de1e8

SHA1
e458cb5489cd01333429ea5c085b962e4bff016c

SHA256
5ddc47f28c45cb2aa7d716e7d52aedc8dec43657d51e9a00a7d0b2869c692a3b

SHA512
6b48939f67e97fbf4e5e63eec7c17e7cab48acd6402912d02c392c26706f372fca0f6e81d3d03a3c125a165eb6db62a51feefb9376fb7c6fbbe6f417dbd9e4f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4e0add3f9aa379689b236d2664a8984

SHA1
da13f50934fd1e61934ab637f1a18a5e03e70aa3

SHA256
8c49d7334b6f1a654f7f5a53ea6817de506c7ca96d7f78176e7e31fc3fb139d5

SHA512
fcdf08e0952f9abe1f339740f7984aab44521e102c448ed765ae69e61e1f42b6f5936574634adc6d42980c8ec4e6d750fefdd0370bd72feead89d2ce8b9fa7dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2136e9f7da66c3515e3278c1ca2b72b

SHA1
06d1314698e229b74cddff7f7aa7c81e2e7e71ac

SHA256
97b21fd14a3f27fa2a8d84c15dd833cbad80a2a1cc20acdd9a84acede34c70c3

SHA512
a7673a2c5564491276bd4b068bab3661a32b0b6bb19637356a53151539ba91da4ef7e42cf9abc43f4b8bdaab36dc8bd41bf37deeb040d590139477db2ab23387

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed77ae83a32122b0e5aac46c3597bc65

SHA1
55561d963d5633217cb2eb3f241d7f809b69bbc9

SHA256
882b53d90a109e168a582bfe14db3a562799d619bd65f7c7ff04be106ac8f9ff

SHA512
80694a1aba5ff76b6a40e3ed85555db5facf8f4e4b722e327e5d3b73bd1b8cdb94fdc6a73e681cfc2557a85913a747dceb797f52d843f841cfefae36f8bbc846

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab426F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar42FE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit