c4bfa5a11f4620df82b20eb393c88ee6c75cc51c15babcb3b236bc2229d7949e

Analysis

max time kernel
143s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/10/2024, 12:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

183014e847af07acc32b3a80f48e4543_JaffaCakes118.html
Size

139KB
MD5

183014e847af07acc32b3a80f48e4543
SHA1

b912c05d99b24495f28377cb46601123063e0cfe
SHA256

c4bfa5a11f4620df82b20eb393c88ee6c75cc51c15babcb3b236bc2229d7949e
SHA512

7d4941c7988394ad624e9aec4ab878f96d398438739789a6aaee4a142be6a2de07295dadbdf38d826b96a37b5b91b23d83e050450eb5ac78903537ed58416065
SSDEEP

1536:SSNFH16thNbsV3glisYyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXu:SS/sYyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000a777e94124fb8a1e15e116a31166af360526c7271edbf173e1df5a57ff7c4e35000000000e8000000002000020000000bed7f24c426416bdeef12f7f1dac8e1f23c0e8bf2c525478cdf649c9a4dd108490000000dc3d32ef81167d9a5057d2d455d39fd7712c42ed033c83b200eb09a9aaa69ca2c58c609bfa63d50bfc83e5f29717b57fe93996e0d2d919c3f3d5c1e53f3f1e2292419b93127539d01dbceefd23204abe28387295fc2589b4740c7a1f6e6d8abd8c4aff3c62c5a7bf4d2da4ce3ede92d77940a69304d2b45e2dbc454209f7c78ec4baa4bc8fb401cfd0d0d41c8abb24a2400000006a606c9301454bea1cf06878157aa834e87fec7423b4386ec13f4196a48dbe75a69be1e43cc17a893189c2af203b0d18910397695621df10d9c7ac5f860a0fac	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d093a8f5ef17db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000837b9c21189542ef8f7212f2e67e8bc23b4d87300daa8bea9f165a7735637ead000000000e80000000020000200000006f21d9512c408193eb74ca82d3774c3ef011af2cd9982f550e88b795918a751e20000000627cc7af5165b3bf3684fd95cbe12fcacd40632373d8b532a2896e10fce9d12a400000000b073eb84b9a2cdd3cd651de81eac09fc5c347bfffb4fea16778666a27629d8367db065e13b85cd95538a517fadd75e65ca1ebec65d5eb2023b16da84f2950c6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DE099441-83E2-11EF-8250-E62D5E492327} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434381455"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2348	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2348	iexplore.exe
2348	iexplore.exe
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE
2024	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2024	2348	iexplore.exe	30
PID 2348 wrote to memory of 2024	2348	iexplore.exe	30
PID 2348 wrote to memory of 2024	2348	iexplore.exe	30
PID 2348 wrote to memory of 2024	2348	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\183014e847af07acc32b3a80f48e4543_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2348 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d2d3d3dff7e5550ee50c08ac89b0b50

SHA1
e2385336788352d93a9092378f25d0e9effd98b8

SHA256
cc5b6f6232da0e6e856ba7ee1920f2e49374e62277e4ea826f83add59d1f7e90

SHA512
27a89a00d981f51dcb296fd3ef7e38e343c34690d15889e7c7b3281b3656905a79da9775b392818588305ed6eb05b157419656b7e69e24894d9987c5bee5f68c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5db11323ba44c1ab4d2c13f0c9fcc72a

SHA1
705bf69f17f593774fc8a793ee7cf37d887ee4c3

SHA256
84cc7bee743a977e816eae47798ab156a60633600a01ecd6040fc7073dd60a2a

SHA512
cf9285357e349f85422fd5c1f5694b100484ced629bb4c8388af3a84a6b0fed60727ee70e243be908ac1def890aa2ecf92af105cba42281c859ef3661e976a06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8828b45d9fdd0099e686ac8e2db209ea

SHA1
b0a1721c37dba5248cabe7fee3e71a37950fb932

SHA256
fdf624d8d79bf03572f3ff4b614b14848732483cd6492e12b8e2ebdc219e2ad0

SHA512
f296901a6ba31059dbd40e53adfb31a9d3da4f1e2a06c09889f2231a5496f71089f1ae928872d01196a43775f03dc65a55fd39b5f17739bda515cbab6fbd4bf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0fafdd47829b52ac287b4a4d728ce69c

SHA1
7f88db106e42516b0fc899bc4ceefaf68ba2f9d6

SHA256
542a5ad7dec9d1aa77125bbcf40c9a19d2cda9602e174352d5e433e606f86c6e

SHA512
26d61654a5a57f75ea33456dceb3638eb58c9fc18bd494d779468ffdc7217fb57f27adfccaca16a23e0ea47a91dc681baba47a532b998ec7b36406e37dce3f32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8daf787e19e3765fd0ca218521ac96b

SHA1
0b42719fb9e13b6c5cf64887b8dfd4dff6e5c854

SHA256
8277bb3cc5a02a8e4736b7025137b4c685c03671d83344452587916977f7b93e

SHA512
aa3882bf186b21ccdb57e6e8dd191bd1c59f22538ce2f3b88fb56c75c6bc0d7f201a8a9e52016070e39f9dc88ac65bdd6e33191c0abce5c8de3268209c91e3d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba13ec6ca85c0b211cf3baa73e36e252

SHA1
f0b8082c3d13de43073628bba59bf7006e4ff349

SHA256
ec0248b1d86d79303bdac3fa1f449d895a70874d4dfb554c0efb0fe6aefb282b

SHA512
e9624a00db82c9f66345a5bde994feb1f17ecef5aa3da0ed4d9a9de2b5783cc4a83c5908b652b14a4481077daf55bc0e4421bb14699d5a475ca064a2a0ed0a32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
688b6e228fa96e47bd5d8bbca5443fac

SHA1
f86ef55db11bf63cc9a3c6046608f13118fb34d2

SHA256
c6d35b7f723f4f7a9de77c1c78880ca9ef3947f8ab197fa8dba02228a1cd4715

SHA512
ea4c3f9f95d638cc82082c1f9654e0c35951579036fb5df8b3459678cfa358c43f343ba3b8fc25fe8635e8e9b27fb2f9d5bbaf58a2d083c7036fdb14c7dd36cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1eaa8a17085a184c9ad2854e46c0d28

SHA1
a86131d1ac122ba79ad07420fe0d1a3635135af8

SHA256
74378c24b70b440e1551e3f4b9d083fe57755b5f61081b286ef05eff3a750ecb

SHA512
76670be9e9ba00c478338bdd807dfa52612201def83dabeeecee783b116e823f11d8773e6bbccb4dea787eba59a961b0bfff247fc8d6e45752ccb1543d64a1e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71da644c35c8efc78eeef2cc4612f05c

SHA1
518d6530e6653f99767cd0e10bafd0b032c99736

SHA256
6257b43a9a4b96c3d113f6f9bec581b988e58575f7f1c9cf29af034a94881b1f

SHA512
2404ffe916e033e602dacf03ebb20c40161175fa1ad53326dc728001bbe7a5969541932ba9cbb16bc2d63a61c8934882d8a745a780bb72abe8f64f857ee6119a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e147b3827aa1d14a477ba277bced5fa1

SHA1
1249b5f4608e0b88981604a86ad5d5790c9ef12e

SHA256
f68ccf42c627eaf23be61e941c41f1fd1dd95e0ad38f81f8d8fc97f6171209e9

SHA512
76efc13b06f7aeb3467c0c913d6b62ea8b6c2032363817d6563174542cb2c6f2b08ebc8013d89667498919ed738c3908c28159223a3a14b32f6961bd672f8d28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92da2a2ddd312ad204e8f83c7bc0defd

SHA1
694a9a91cf64afc4e40f8e610a62a77124ef6307

SHA256
a84c951a62ab7aa461d1577d6228f88f19cbbd2dba5630a974f022f8f34ba852

SHA512
7211b24f83c68291518b550059134cc7c36e3ea7c9dbd353469c23e3f82cd55b637532c23cce419dd29785afa07f40be6578d75d3181fd2cdf169e6697c56904

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8003ee21b1aec12c86a2641bb49b3a2c

SHA1
741e8c828bf56e57b7c9c97e7833b63f39b1b8a3

SHA256
030f4065a60fd76affc596dd9c6b0ec7e54a2cbabaa9d6761208044e7258e297

SHA512
5b0e971b01506b4da97a72a1ac5cc2e59e784b95c46201c1f797fae37e3cc8c7883535b28d4777cccd9efdac4d41ff00e92003a7095b800cc1b1b4278b5023ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e00f091799d64353cf95d9060cba479b

SHA1
b7d4e5c4a5434789e94c65b73324b2fa4293467b

SHA256
0b207064240691dbd2e3c984e8d9bfa58d579e226c2cfe7a6a8403c28f8abdaf

SHA512
69846d89ecb156ec2418493a2f4672fef547011f954c9edfb9207069beb1f03fe15d9e335b592285a13f7f33810c24e2fef725170e3d3fdd442abb8257273ee7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16c2bb1898c299c05f3a8b00528f8901

SHA1
990eb823488af77885537f01a94b6742e246e57e

SHA256
2abf2e7a5fbfa6b82882c7a98ad79e611378428ead2959b2b53f6ba9e84dbbcd

SHA512
e6dd490193dd91954cd253adae1aab16c29765ab70bfb8cb8384031bc453a711d8a90f56ab54cb2dea894bda2ea699d53d319318a1f31ac752bb853adef85249

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74b5631afbc1695b9575f69d34ddcbe4

SHA1
719162704f45922b319d567072342468c814055c

SHA256
cf0ccb186275bd9aefbd0ea87abd3a36edc7787f87ed59f7db40526d92d3f907

SHA512
7d551d970e9fec6240c14f5f4b85f8ee58149ac8175f83f2b9f732bbc609fc3f6e756077dfa1601265722fb4444865138acbf0b5a51589b1bb9d53ced08b576f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBD75.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBDDA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit