af3ac6715f010733d1c46731140cf7e3ec6b75ac0adc385535af05c8b3b21484

Analysis

max time kernel
135s
max time network
114s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 00:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

27809918ebef8673fd231ba81182018b_JaffaCakes118.html
Size

214KB
MD5

27809918ebef8673fd231ba81182018b
SHA1

3aa884c32be091058ab591ec431d43caed02198f
SHA256

af3ac6715f010733d1c46731140cf7e3ec6b75ac0adc385535af05c8b3b21484
SHA512

44a9c2412eee3c233a7c318d0ccfb69875b21270869fc2b8e380eafcc85fc8f35f66a0dbd2ba0d87d96f3e8c498800bada954e6ff0237f6c4ad88258b6c93b8c
SSDEEP

3072:crhB9CyHxX7Be7iAvtLPbAwuBNKifXTJDG:Ez9VxLY7iAVLTBQJlDG

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000e18c4aeb5526b4cbd6ff3cfa78cb7351b5621715ea0fe274621dd9f1b3f97634000000000e8000000002000020000000775accbbc0023d6e4fdc586baf0b6d562ea8dd394e31f31f117c66a85019a3ea20000000eca2c15ecaeb2ba842695c86fd1499549e6028eaae88bca0c18df334d47531e3400000006ae3d638648d186cfbc551015a4ae123fb3b65abb20dd85afe7613bd278861f3ac10111d1ed84672119b1a0ab7281ea4f9fbfc8c1b2d1e1ff34e255332423dae	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434620223"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C45A5831-860E-11EF-A641-5E10E05FA61A} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000c61dd3dc934b396e008fd95613a78dce1aa0c249b35d3b82b35f393a4583570d000000000e800000000200002000000066ef020d462c567d9c4e845c996b337c89e21ba16948e196e948afbe9cd0c73490000000e1d908a0cdef05b5520dce1ba95966844de5307f16aa4ce0ef2fec2b1b7d1deda148bbb2fc56724e744c33c4b172f3fab0ba2f17e65b6a960e8e377669880f2b68c2214fcca8f8764956de90bf8823a9f9156fc90806a0c82de6622457f693c2ee82a10890856b36b41696419f1aa2789d6258b933a91fa41e75ace7acfe2ce7d3c7de7f8ea402aff88baa7ed3b898454000000094948f1ced1d863333d63cca767a933901fac518ac56e8eced4af6e0f9ae68ef183048665534cc80b23512cf259d4d86d262b1c7cfe4e4c5ff09ff721cb3042a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 902b73d71b1adb01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1096	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1096	iexplore.exe
1096	iexplore.exe
2104	IEXPLORE.EXE
2104	IEXPLORE.EXE
2104	IEXPLORE.EXE
2104	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 2104	1096	iexplore.exe	30
PID 1096 wrote to memory of 2104	1096	iexplore.exe	30
PID 1096 wrote to memory of 2104	1096	iexplore.exe	30
PID 1096 wrote to memory of 2104	1096	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\27809918ebef8673fd231ba81182018b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1096 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
215bbaec1cc7fa625491c27b941e247f

SHA1
15f7a66678f9f4b5c68eee446726ac4755647a4a

SHA256
ab49b0872a0a3ef1deab896917014c88663cfec35ad7f950780caabe7ad2a192

SHA512
5a96cdf69953c4083e7f0724fc215cc4d7f19400ce6a647e6263c8eb3b8d87f4dff5493863fdf241ace1fb81c8db6adc39c079d773cdf457652de224066790a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9de776b9674794d4c095957b4808aede

SHA1
9b7d23f047aa9d9546115b52a0a7c84bf601e9a3

SHA256
89bd934059eaecfc09b9f8f18e65b9c5d99583fb5cd3b8b0e4d2e08ac5b193d8

SHA512
193a093b1a12ca4ddbfa91729a7faf21bfc686e6111c90e9509e47d0622b49db019ca951fd7410d3d3312aacaef7a5f3dae8b11ca35dde8855186869d25baeed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b24df9f9775b858f909b7f35ac402a1d

SHA1
c031d21d5000b78dcd16c5337c7da1709e14bcfe

SHA256
c29d6d8e9500aa2aa4b1916d14964f59ec0a3204d5742bc653ba49fdd74e1420

SHA512
f17eb04b7eb385b34763a98b83ce599194d3e038323f0d42ad2805f59374797c2d0dbbc42cddced184f5f6af2d36f41f2fbe105b5c16dd2147a861c9f32a11bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e6fa7569d93e762569395a3a3e709146

SHA1
df956ed479f0deed62b486fa85457892ec16eceb

SHA256
3d9f416389ec73747035abaf4f0f86ca69dfb8baac8d1cb616462cd005c9ec83

SHA512
53dac478c7a6a68c4173dd3b6037e755609356487823d1fc9cc3c79d7ce39fd51eb856cc56d61668f60ed5893e93720bd209ac8d058a19ac0ebe2d9f3bf28d35

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65c8ff6a1aae79355da7d84735a08912

SHA1
6e538895bba9590a60098236d5ffc34d152f9107

SHA256
bb3d58baf0f285f1c9a80a8fe3b45d025773ee2d52b81ef0c97cf2ed46229dec

SHA512
4e96b7a4b5e166a337f7469f92ad7e43469b94b7918370061fc4d3c9e4cd30a06abb03e9d520829b218706c34f43f1c30f4e7179a5036a99ce2ca22fd630b3f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5accf25451426ff8bf24fecc2dfbecfd

SHA1
80a66ab3e2c542bcd84440ce051f142e627f211b

SHA256
385b2c7b68e3a27a162b35f58cb47bb97fa13741a58ecd916216a0484fb7f28c

SHA512
ca4778ff62bf2c7cf3868462b208435d004acdf97ef3a7daf9fb428584b31105c596dee99ebd9253652f2f67991446f76f78f56d0d503acc223a1526ff5da184

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b2615f3b9d7d0f33390fbd02971ecf1

SHA1
08f00f2eb700838bc0dde9d15ed353d984ee0f7f

SHA256
acf6254b825e9232e5396177445f7f31926331970b09fffeb76f37b716e0d5d8

SHA512
234ea5f5cb7a02f66ed0b87bb16d9caf015f04e5a42488760a93df1948249cb74db3b34ac55bc338b762aeb0dd3e6250fdc10636035ad6455a30e13f5356c666

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bff9ee3d829a4d9d4fc24bbe0efba108

SHA1
02cd3e24b2cffd8ef0b93c69603496186d102aec

SHA256
73f60ea8aaffb9a955c4dea4db0c3e94fbb8a48f6930ee648a7a7b556a4a4226

SHA512
aebd45d5d406ffea61ca93284cb8a0f5be391ece59f5ab01422c4cbcd29800455f562b7584e1013cf6a5ae65df8d8dddd7ac76e942fd0e6cb6135f5dc3bfaac4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a5e11700bfd26f981710bfdc5ce749b

SHA1
28c1bd7cce65543c8b75e2c44e8ea8c339210439

SHA256
d9cd7e3cc628293eddb9e9e2630e2f0461ad2cc5bc2af9022b9fdf7bf26f9f77

SHA512
8afdf3d6459e4c4217cb98092c3b2b0445a5bdbbf3db26321e648ee06786d5856069c8c3d654e61287a6af3129a63d8fab55ac813c53b6ef9faf3c8ed2d04f8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97d6e8f8352d952979ab39453bf00fdc

SHA1
e7c7cbb4cad3b3a7358fac4b40caf07001a05768

SHA256
1592aa6ba5778e022c75510e7086a685abb417ed0d9f1c8d374bcc121a374786

SHA512
9186a605428ba949b7155e3fbba90d33db4de78fb4d4b2f98ee335ff227bc43cf38c0aee5b4248555bc4b54eba4fa0836760385c6fca06f9778f431cceabfef3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd469ff9ebf68f11519e16187eab35d7

SHA1
21b6a70a2644029118c5a9be93e47710d765a30d

SHA256
cabaaaa73960ef9b68552de7763d1665460662458a88392e0e5b6600ae70ddad

SHA512
45ae7d7f6d1a757277bb96eca31e8cf68119e1ee95f41b87afc6e8c1363165f8760885fdf0c3acb5df8f26f51e54e2a9303d59ed5aa1ad27c94eb60b90959e2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b532e2f5e8a1be22c06ccc2446662aaf

SHA1
b9b20c9c07b98debf6612e56a4f52b35471a66a6

SHA256
092ed1d9864bce9eb4c0e1611a4ec434081ec03f64f794aa0691c071d17694e4

SHA512
e611ee65d7153a1edf6d214e64e5a56c75fbdd1964df88b4c33ed4012aa6429dfeb0f0b77708c18098039beebfb642b39867562e475d37b4623b82b40a086c1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e6ef13d582a890468eb28cf67725ff8

SHA1
5492708162168b2fbfc2aef93ed23b023a475076

SHA256
e4ea2f311c3aed2b99873179b6fa178c8f2d22c4fba17c213d4e6db0da96a48a

SHA512
0cf08ecd72780cd135ef46b8423d87dadc5df9447c1ac8ad393a5b57dac7acece89f44e811904cace96e8cd8faa4f5b068338ff637a13001521a540b779fe94f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
676235a247dc96d61f3c1648dc19ded5

SHA1
acc36ed50afe6f96e57eb41e673542ef211322d5

SHA256
944b9fd462a998e0284d96b6a2097f12700bd6345b6fecdda91eb87a06a8a158

SHA512
352951c3e4f2906e726e71b8171fbf6f008a86fd5c231368f35047a8f1e77e176ab589cf6d5256dc8b2b6de4ebbbf4f3e37482ecd0b942bce091f557af082217

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85c5f96f96320a4e0f65fe06c6505d6a

SHA1
ecd42e1476688d7d389426c49ffd4cb3e5875725

SHA256
fb9deaa2c55c87f13dd9405c719d177151d468c7c07f651827753b2ee909042f

SHA512
b0729b3b5518acab97f1e7e73db6c6067c89a90a054a78a9a39a2ccbfb5769f375b24e8fd9f96d8bc1dcab05fa81672880b62e7bae4b61a92df45e1844dccd1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7EF2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar809A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit