7b59d10775fb3d20ce3691aea210fb56fbfd624f7245f27fc71e33cddc9df9f2

Analysis

max time kernel
133s
max time network
131s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-10-2024 01:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1594f4e41df93c695ab9110d789fdac9_JaffaCakes118.html
Size

6KB
MD5

1594f4e41df93c695ab9110d789fdac9
SHA1

e4034ff112f4eae54a3c5c822843d2462539624b
SHA256

7b59d10775fb3d20ce3691aea210fb56fbfd624f7245f27fc71e33cddc9df9f2
SHA512

82b129b3151ea7c14fd0512480b56a9eeeddee246853d873dd41a9391213a750f872bbe5bf0488327058282323651cdc57b497f69ebf91574e1f9ad14b01cef9
SSDEEP

96:uzVs+ux72bLLY1k9o84d12ef7CSTUTZcEZ7ru7f:csz72bAYS/Wb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{37CB1EA1-82B6-11EF-90A9-D60C98DC526F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20becc0cc316db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000a39add33f234e766c7dd973b60993dd20c34cab303340f67571588ab9717c4d6000000000e80000000020000200000002f5321753c4690da0b2a5ab640c24af2062fbd6b51eb2f11f9c847df613756e79000000031e684851c0bc779ead6c3284e9c31dfa73cbe170cf5abc224426364122ecbea5e1c5e09bb2769d8f9e99a85228b14ae66e425288f1595aa3c83b5fd9404976f07cbd598df44f0c6649f46671d671158081efadf00e8f183bbea222116adc2b6fb2733a31515cbd4f3f98efeddf0904437248898c4daa67756fcf0f2ecd14be4da11a9b47b107253dd9eafd6856e93ae400000000569b3548ce6f8263506bc6e3eff8dbdfcaba4ccf9848ff180ce5d07fe513c303839d22c04bea071eaa0ce8f1c3507a63a45557e923bb5ba0f42c56427f44caa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000901e897c86d83c596db40c0cc29f38263d508a7ef5094d5d9b5ced2705b6ea9e000000000e8000000002000020000000996ee00e71e6cc2166e5acb388555bf8e6037138355112cb87515e9dd85e9f652000000091fb952eeb1506984e16fddabc7c3e4338123bfb05f7238e022f750061d08d2840000000a7fd8cb77f21d2a10ffcb2b2eb17de8d551e080cd15bf6dec37626797e55baab2fa5abbba02d1ad34eadee78535e435138ad0f7c34882bdcbfb61c782698e6da	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434252327"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2068	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2068	iexplore.exe
2068	iexplore.exe
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE
2748	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2748	2068	iexplore.exe	30
PID 2068 wrote to memory of 2748	2068	iexplore.exe	30
PID 2068 wrote to memory of 2748	2068	iexplore.exe	30
PID 2068 wrote to memory of 2748	2068	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1594f4e41df93c695ab9110d789fdac9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2068 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
caa6efede6aa4de404892df55e13f348

SHA1
648f2ae168bd9a3a2e726fdf066456ba979f4468

SHA256
0a666ec36f48bf0f6918cdae8fcdb6db6ceb84c93e846505ef499e9d627b1512

SHA512
c082b82821901a714557e387f101ef6db865a12ca2dddc78d90aeeeab2317e59d78ea572ffad7bcc33ab611d02169240dc9ce94613491508336536ee8402b036

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2aafa03653e27af02929f679f2daa4c5

SHA1
4dcc81472611a51760591d6ee36ec27eb80026dc

SHA256
44d0c0079ffc3480225a5985fd68ecf65e381a0b7fa5eccac935b0c9b8a1d9ad

SHA512
79e2060db4242fefcf7b059a53f5f8d281ab08100fff45f031b779da3eb4e8e6779b2a71f4ad23a8a94c0014e9ab57d760349644fc160e62c9158477ff7db361

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4dff905fff8ba031daf2e17b1a18aa8b

SHA1
04a92364ff4e45ea9c8a6aaf027a4f19a8787980

SHA256
4ab01825edbed8077c51719bce2bedfddf56c5c7d842b881f543ac2c69f7d90e

SHA512
d435325268ad7ff8812e30f89b212a1dd7b389bbdc441638e40f4f626f5abf7b49981a01fe180a2d6c1cd4aa40928e3d607d70a58eb3b52f9a134e78a4b7ff34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81947dc656edd622261981191000152e

SHA1
d7790bb64f9f084ac9bddc4479a280a0aa5541b7

SHA256
e3befc1f7f4e95981fd0ace3604e9ffd8188ae80adaafa1a4e618d7092939719

SHA512
85df0a112adab163d4682ed2bf5a2ea173aedd1cf0143a52dcfc4df594c071619e047350eea994f390ff847167a99c1e3994d1f3f53a3f9063ac6c2447aec1eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78a35dbccf5f00ba53a204e477e00063

SHA1
40757d9d441e8edfa3a714339c70195f303cbf41

SHA256
d2852caa6a5f29213da654aad2a0652cd6c5bb8639d33faa9e82f9a846207f06

SHA512
bd46c534649fd838cd262264b41eef7dd00c98e2c20c22a32c3c462d3ea6c9f4c424438f870b94f6d93923cb71dd51abe440df8db4862555dcb6c43be1c6586a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81a71926294cfe947e44822b8f276580

SHA1
2649b2ae15cac20a0132346eb2d34f181ec7569e

SHA256
34368d8eb5a9016435f64dd69de7765b3b966e340eb1dbe80536684f01c287d3

SHA512
50c09cdff34952451cc3f7347f3361b7ed32e3b410fdbb0a0092fe1383be1a17b9b30a87e274a1732e938eb8c3af919c8a8c26baf415c841380cdb9a434854b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9845f221b7448cddd4e73b203eeebc86

SHA1
e83f2b71afce39d74bdd11bf71a32c87487fe7e8

SHA256
33974dcde573f8119ebc1792ff88f2340b7e037365cfd2bfc39809d63749c530

SHA512
b1e275286b45653ab003fe5954dd88ca4d713bd2e43e1c1fa277048f39cfedf48940e3abf06eea9341cb83f2900d7076dbb422d82d1c066784a9df0258da0c49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
56e493176701713c0919abb54fbe73a2

SHA1
a85c2e2ab562651feb73494c62836e459c8871a0

SHA256
a20f72771a7742248f307e50b730708bbdf91d5acf441a312b264e24591d2190

SHA512
267e9bd4f0cd83350b54410e129d2c33265dd328fada5ed1c525a91a6113b9f96ce00cace95c6b5b19b12d305c5942e8be851f436a65c1f0314838a9b3cfed0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7ef755046c4501b2e75addfeeab12eb

SHA1
7e30597c8e309db9f9a2a88d861924ec171fc8b8

SHA256
869c83ea711f61e4d68aed9f310eb254bb7b25a0c8730c4eada1ed1a20ebc7e4

SHA512
fa67b77d5a9c24a2b8d43b746451837e05f88104f99680e4dc28d0b6b2d0f51a6cc949098d75f566c5657d1e06b45c56c4d9f39106606eda4ad8d191a234254b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c010b559c4f7212d0e5a864d7fba4d25

SHA1
73f22e2d15fb6e4602e4c3bb85e4aa2b1bdaf88c

SHA256
1d631224c162c15063c7ed918ce6bc9ecdc4ed3b84df5a9e9a73d751262fd4bd

SHA512
583784ecfe596fe6ecb44f4c224dba71edd73d294b9aef99d3d16833eb561a6133a5d25e988d19e4720c35230a211d4efc4f6d71bebda23553f3970bf7a419f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9c9563b1c785e1d2a28c3eb4db8fe83

SHA1
6312e2e156de5c4412717016c84045ef494f6bad

SHA256
5b4146bab71d375bfac6f7565caf6515bee03f0c3cd793ced98f5dd189f510f1

SHA512
287fc3a4d47564547759548853acc8710fbd6514124f883caa466104ff00653ac85ceb7671945c765731e64a115a0f23d1fd5ca673a082844e6dcf7e53542c27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8b70c38a41048c83f30f63bc01012b6

SHA1
458be3ac8d515036d566a4d72e9ab3c034c83b7b

SHA256
c666088160f4a207e3830799559ebdab6cd8f6278b46ec96a836fc65289a4cb8

SHA512
005a9d68a286b788e85d5c55c2328cf2337ca1e8ac5bfd202893f2bde8daf7c1c3e2d4d413a390976d0e478f8fa1b2c1e96a257e66072a73a00f3b6f42109825

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22bb006275f30b9e33b311f159015792

SHA1
746f9e9d5a12389e2ba39cd1689bd1de1e99facb

SHA256
ad28aeda09e169f9e9359dde62f42f98e9ab6f859a58c65b75deab412ff81d29

SHA512
a5282070448d8e6841bf5541e7a5a5246d2351af7d4e458ad57662b39dbb5e664973cbbbffdb7695177dfff16695b7ab1a6ba3bb540a5d2492827be22464864b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd5b8e05302af7370e6035eccd6009dd

SHA1
0eab196a3487c9e36f97b9e2730076ba11ff5da4

SHA256
4d99f21c0c64590cb7d530eecf32af644207583dce8585b39924794d540e364f

SHA512
f81d21947a00af68d2b290c57b83511a76c606ac761a8176c790e256723e579dc44387a5ec02d18446a8747ad9ee9dfd73d4d4f1a1bb186b804254e8ec9f6383

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab173B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar179C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit