f5ff7c9bd77c2352f26f3421ee3808c499ee1ef530c0af980ef80228e3dfd91b

Analysis

max time kernel
118s
max time network
140s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 12:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1366ba5775affaa1472c7a9c5e2909fc_JaffaCakes118.html
Size

7KB
MD5

1366ba5775affaa1472c7a9c5e2909fc
SHA1

842740674b2fe8e32a12acb77c5160198c3f60de
SHA256

f5ff7c9bd77c2352f26f3421ee3808c499ee1ef530c0af980ef80228e3dfd91b
SHA512

7604fbd462c270aa9e2855cecea0fc1fc45c610a4145d4b4df2031893a909e1d8e681cb511586e9553daf838c40a19a4c6b70eea53eb5fcee16927c768c0f209
SSDEEP

192:dJtpsnA9is4AzeQXqyfj8GJo7rxHN2mG5oJM:DsAv4sjJo7rxHN2mlJM

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f000000000200000000001066000000010000200000005d41e00caa6cb368a0aec71b024c12f28fca0ce6c9d124fdce798ba8319e13c8000000000e8000000002000020000000ac65514924385324c14bb3a364bd5d3adca2f63a6e5afb091a08c044e77032612000000000b42c91b3f54e56eac966dfadc10b511241e4fcd3137aebbce52e5be84e7800400000000da98df9a935ea01b4c5b516c27304d3101ff5f3c1dea1a2d24e6ddc182f0dede5e5667917bb412c497bccb03c44756494f2e5dc4e087887923e7592caca2e9a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{19231BF1-824E-11EF-98F1-4A174794FC88} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60436f035b16db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434207610"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f000000000200000000001066000000010000200000003aa90765b93889a874410b727daa31a3beb477317d4231e944b8a0a012611ec7000000000e8000000002000020000000658fc855f97d7e79bfa77423dfb9ed6ff19fbfd0d16a3b596283948f9c39a3599000000016b304bc9ab3870189d721d229622563efc0f8137e6ddc27d606126d8827b2823c4987f86d2fbbd7406053a0a6a726c328c4d093cd333001b575fcf2753a70f39abe83073fbc4366cf9514df790396345b1827131ede776718988dab0d456cd3cf21204c20483ea30ef071d273c41c3064e1ddaac9ceb9121f98f052a343df60d2f851255d11789c151a9c5d664809fb40000000faa62daaf320aafd4b89f878a25c2956f0b7c0299e8077e292dcee8fce5157f57a8f244fe156e8b6b5fba105568290ec06e0c7f92546620dc37d668ab7e0622d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1648	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1648	iexplore.exe
1648	iexplore.exe
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE
2968	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 2968	1648	iexplore.exe	28
PID 1648 wrote to memory of 2968	1648	iexplore.exe	28
PID 1648 wrote to memory of 2968	1648	iexplore.exe	28
PID 1648 wrote to memory of 2968	1648	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1366ba5775affaa1472c7a9c5e2909fc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1648 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
494052c072341361772d105a77ff6c06

SHA1
76956a209f071e57511c313848cc81aa0cf00456

SHA256
8879a74686ba0b2b88551fa9a6596ef25a34767c1cdc2f8b4a7d3086d5f6c9f9

SHA512
89c7bac1360a4d753f9ed7270c74cae693dec8c203b167c3fa8613f6b97f732fed2fdf01a2a86c5262c32dbdc8402f7be0706bf35703375021e323c2496537cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f040601c2611eaba73320427e92cf057

SHA1
d670a5f17e58f63cdf949ee5b202e310a65de0f9

SHA256
571e80c08b255246dd835690194fe1bc34290419de3ca19c0c0339ada9374019

SHA512
679eec11158e94a36b50272b7655b412a6973a0801b538b72f4875641f68f7126eda7ddd17f6a0a48b76b76fc99e15a2442a48a7d61f484f1f2f3cbc3867fd3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06c412768030278a188bc9e8ca4520ce

SHA1
d7b6368bb42302260f7e8d81c479888854bf9bbc

SHA256
6860a11b94e45892d8bb1afedb7a16edeb2ed83a7b19fa2f10b9489227ea8fc8

SHA512
1b7b0244fb497b9443f218973d882e6240ab8e7dc045bc75894320accadbee1781a7f31d34fc762883ccfc471680afc91c95d058ac9fe57fbe726c2567d01ace

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3bec9f125a58c43950942f510c47055

SHA1
6cbb1c48f77b0617ded042926e11aa058dd52efa

SHA256
bf9062355d417d6045e32423790e8bdde2fb48a53859c773aedf104108bb1597

SHA512
099f5fab3254108f39f8ef0214e060fbda82cd7e413558aa4c3765e007bfb32a5cf62559e85b9cbd3e67efe77a6d1d74fc1bf81eec38701b5f285c76ca5a451f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7df4dcbf3d81b89570995a5b87df0e58

SHA1
68f962b828fa14d0513f1658d968462e06dda334

SHA256
929646d3e261d225a35c869d4d7f442a196074d6832f3e96e9ce45d83210b16f

SHA512
93f2e3fd4ed2ef01317d47a941b290caec3f48cc20402ec32b7babb0befb36f590ba3ecfa15eb6a7dde4ee9a78b55b2edfebb64828349ab392781be6fe7a15b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a42b7fbac739cbba440ff991d1add3b3

SHA1
d7451ab2fdcce573261e543cf4cf6812a1d87792

SHA256
28035dea9e7c30c40b8eeb7ee5acf7c6511b67f77b2f8c7d1db713602f1119a4

SHA512
5d06706c3c637466ab36b7071eaa9956d6809231b8ef923d571e17553e436c5b0ad001d8a5d45fa57fd7763334fe9c7e82c2f876925013d7755e7807131e254b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
abdaa3f42d6c232bda5f9f1643673e3c

SHA1
274ce74de1a798a6946af5e2d42063cd494016aa

SHA256
7c0b6e25e1eb6066a69580c07492c96ee3e37228c9a74ed775141873af3da484

SHA512
7d77f6a5709b1dee3d6eddf165e3d5d921028351d352d693468986c8419a347fa5acd4ec2f77402690e085e53186710e712f76319a971a4bf8c341243a581a1a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2573c227aaf41848b3adf060d034994f

SHA1
211d87879c402e43c033250b59fc03ab7f03bc49

SHA256
3a0ffc43e8e2c9be8955f5002598456f6d590a96e87c85f7e90b4f03c72d2e07

SHA512
23ccb3aad68457a8eb2f95dc6a49d711f5e01c07bfdc7406e1c0c52f0efe2a304cef8101a81db95d1fdab7563b7960461dd8f906f5859612fd95f11288ab3f82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fee5b6bc811ff6660729795ebe7ecf88

SHA1
b98895dc9705b7431ac5af89a4188f634caca2e6

SHA256
608ff1d4febd0aa41c9411afa25da824d0049196e1de1507dd6e4c732368f58e

SHA512
bd2b0450dc2ee584e5e7326314b1ebfaac2543135bfe9d924d56a66d996d6ec5b9492009732295afb81fc3e475f0bcdfca6872d1bcaed726de665a2ead4eeba8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
767ea46a50f0504a7a2d5775ce5dc5d5

SHA1
e60bbecaff16060f5786111083ecbd994c6ccf5c

SHA256
ae124455cc7a6a9b713a13c0bc73278c8467a9581507b4479763dd61022d6dcf

SHA512
27a821c92cd2a54192c9f317554d76ae0c2d632ae386fc03c9e1f0ebf6c6a60750820d5e891a0caf084c20d1397e876989fb2f68abbdd9d2cc45a245b9b8500a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37906cab379ebb7001f6c75d319ce420

SHA1
9739707fa67a6c3af766de5c35da3880373c271a

SHA256
687facf59f7261f186a2d785816db00f872c029778af6943f7a097096ce4dd47

SHA512
8177389f836daa5a8e5bff405cb77a8c422045b84c947c43cf7b629b51a693ba35044b066503ae7bce7319712f8ca9567331575fb779e2bbcf23cf95fd43665e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e460f8688768ab7a07b6dc5bf0a05406

SHA1
aaac8a91397ca0c2797f7f2553f330a7f248d19f

SHA256
41adb6320405ebdb125e2858b2757afdbff6acda67ce34e30634433f4913435d

SHA512
4a1d2f67b5387ed6e836e52fd9ac6dae74ac5043701f6c4f63aae82c16fdb874a382d5484da367eab2f777eb91e9c77fd074320cb4d57658348c20d451fd7b2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aeff775497ecf5a0674403d3a05bca3f

SHA1
960df7559282017bdd93b3c7efdaad56e45b7daf

SHA256
b2ea9f4a56f6a3037a8cba9fc6ec3795b7a55e49e08aa09276ac7021e85848ea

SHA512
9f26c95f08db2d84d47bc3ce6709d0c1c8f2f7e95dae795640eb5f2a129dc25ceff91b5a994ead3cb5e042055b8bf9b166b34cdc23c0346c6503d1d4eef982bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b4c0eaa8efa1637129e8d8374fdf261

SHA1
69a01ddfff5456616e2d1aa5b109434d8142dc36

SHA256
24796131cf90804e08e9209605ef01d527747bd4bc82b9d1a92ae64f5bcbc996

SHA512
2a88b89ee002e1468bd47a33ca016f9837781b12fd7569edb90eff223639eabf22060d5a07d02eb286826dac1f672c5099fda6e82886de4f87a08b5298f41bc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf76611c5bafb19696fe4c44482b7dbb

SHA1
dbefa4b667505e0c5f7b6f432f9017559b0e29ee

SHA256
ba8bb9ca473f607c11a2fb557831c06120984516d50a9ecd729d2f8fa71484f2

SHA512
3234d7f1fb7c17cab1b1d19eb64d6f2e7c5396eb47ec87263d99bc1a46ae86438436316daca05bc9361ab7564d5e7c8900359633dc1c9bda160b22daae0b07af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab61C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6CA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit