7ebaec8b445c00627c1b25594deae9505733846487789e748cab6b1a1d0b2534

Analysis

max time kernel
117s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 01:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28a4e236ce465b46a6c3eab1a0615702_JaffaCakes118.html
Size

53KB
MD5

28a4e236ce465b46a6c3eab1a0615702
SHA1

acf2c610064d754385014b68a7eecd7b630683ca
SHA256

7ebaec8b445c00627c1b25594deae9505733846487789e748cab6b1a1d0b2534
SHA512

1af5cfa5949c5eb0c3192e123bfc67724e81a5b68ab811410fb15e8b9547b5a0f4e81abb96e70dcf4cbb00dbacf24e7853d8e0e90eaa8be8d23cd26925432c7e
SSDEEP

1536:CkgUiIakTqGivi+PyUIrunlYW63Nj+q5VyvR0w2AzTICbbCov/t9M/dNwIUTDmDA:CkgUiIakTqGivi+PyUIrunlYW63Nj+qw

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6DE79E11-8620-11EF-9CBD-4625F4E6DDF6} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003132192ac04e5a49a8ae8f32bdf5b527000000000200000000001066000000010000200000004b9ffc8072df752090de96b086808fa8aa10b1ea970c6c8d50711661ca597d6b000000000e8000000002000020000000ecf06fed263d203b9b2934bdf061d45732a99b03d8eb9d49318e3a7ed22d3c112000000088e48c5daf750fcdd13f5f20e9070ba4a7f98a80271df6d3427580166805de50400000006122e142d6bb5a5a31d5ecdf5c0290316af3ad2e204be7e7f160294d66124a8384cbf9ce2a45f0fbe27d3d8d10065116a88aef1a9cb01a662a0a653f64252372	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 308baf432d1adb01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434627799"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003132192ac04e5a49a8ae8f32bdf5b5270000000002000000000010660000000100002000000014dbd1fc2dedeffc6af805b220d13c72e6ca4fa89323a5d93663ea3c54e46adf000000000e8000000002000020000000c6231d1520b8685087de492aac2d5df4eab1f86a93e99f0449bc92d80db650b890000000609953bf7051a6da726bd5035ab39b388e9557487c194482e70027cb10d83b7b638ec5c87a0d094252ff2d2671c21f5283fbb34e73586607e8aa37c1646d32f2e0111bfefdad51f313ad6e09d161666791a03362f4b5820594c1e88f7bbfc391db637bce77b261e0212fd623e2910f7a88bb31cd96430599e69354026e638f4f05f25f0ce4495d9f3e57fab6ac705e5140000000400c93b34071d9ddf970434eb7ebfc4b58f2ec1ee5f1a21f459aeb347e176dbb9571bf3d8b10c0e6797b697fd155fadd0ec865144c96b513d169d92eb632a05f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1628	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1628	iexplore.exe
1628	iexplore.exe
1412	IEXPLORE.EXE
1412	IEXPLORE.EXE
1412	IEXPLORE.EXE
1412	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 1412	1628	iexplore.exe	30
PID 1628 wrote to memory of 1412	1628	iexplore.exe	30
PID 1628 wrote to memory of 1412	1628	iexplore.exe	30
PID 1628 wrote to memory of 1412	1628	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\28a4e236ce465b46a6c3eab1a0615702_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1628 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d8ca3acb7b08e8ddc6cc8f8449738e3

SHA1
2cbbf1bba598359ab2138ee584b84a9d453890fd

SHA256
e8c3e2dfb7fa082ed1bc426870bd11d5759778976e0795658ebe1bbe23f97e7d

SHA512
4118fd6d27e5a1216f7ebad3d0a180f4098394602997c3a292cee7e8deff054582317c049e4f4bb7f86dbf70d3139cdc1c1cf2bc1d4b097b335260ec9dcf6401

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d81abbaa31c68dbf166ffb0d175029b

SHA1
58a01ff0a977f89609acca71926e743e6f807bcf

SHA256
56d82ed861909319837061b136e88d805cf656a95b0f77b74f5cabf5a81429bb

SHA512
647bbf8409c270171f92294f9d81e95e7dcd5a56d8b58315162775f63311743c07732c487dd9352b1c82e0ec1972316e735e9bea24cb18f5b8db4c9d91f5ebae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
816941338d8917cbfb9d02e93b19346b

SHA1
ccfe7fae69c61cbb95afa5ce742ba6af39b2aaee

SHA256
dde3e32beb6701a92f7d5bc6879f0d19044ebb0ed4ff279865e97512fe7fb547

SHA512
18756ce98004b82e91cb8fbb1d84c7f10c0e0152f3408faacb193e83ff0f184ec4ea69020b8f43f8a31975d05f06ec2614a81f9569222dd2f79e2f5a4a11af5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d41f619adfca5714cfd2d2ca166225b4

SHA1
3e834b6ab0d582305869545b5cec1afc6385ca91

SHA256
004778bcc2e12b4329138eadcd57a87cf5efaa0bc4f72310f11c60c9f1dec38a

SHA512
cbcd6fd83352b224d4391e9d8b1b1251db11cd217b497421889029e574818355fda0eadf8962b1359f360de2a5c3b4b6228d683e7955360ab50011afaf86ac43

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fba38155a4a64c81ad2b37d529965ef6

SHA1
1621afbcda2fca11531e2563da8a86314c4cb90b

SHA256
e20ba4b58be11cd2a1411ba2a6d2e903f63c97c1736eb695a9499fc3cda92f2a

SHA512
11b660938ceaebc0692137ce3c1535edb85a6c570d28b9f810eb57c530c8034e1fc66b6143657661c6b093b85e9046a2d889685418e8383c9a19cc336b25c3c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef239231e1468af99b22cdb25310a011

SHA1
7328673612b80400aa491b50812e6da7dc275b00

SHA256
beef200f24782a0e8487d93df19b4b7e237d25f280a761031d25c9c88ebf557c

SHA512
d0ed4b3ce0ab43df8e7e1be6ec9c0331bcf95823836963f13203a929e9b1d1a8ec59104e901edecf4288e83bb3e9427e10ab774fb84e1cfd5af979a0de64b9ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cca2a484d2f5aadbeb2edabd2b448fcb

SHA1
a1aae29c97710862daef9e7c0e32484e1b431d4f

SHA256
b974b84bdcb24222ab8b3224890b0e33a7babaa99d8e6c26c8cdef450d8930c7

SHA512
29759afb4a00057cc82ccc7523244a484536576f43cee2c8b59d2211f07dbce1bc58c465e3d4237f70343870e5c9c2fa5583163077a4fb04901a8ea31e5c7de2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ede03210f78d99db8906a8e90d460991

SHA1
920294f8e33d9cb9db517b362970d2a9c79def24

SHA256
48ba673caf0e43ca11a564bf0890fb3cf51d5ed86a3b48fba11cc45662d9617b

SHA512
9b91a126d78ed4a4f59dd8fab5e41a067b63e4fc0b2bc44a3db52786febfdca9e979545045397ca44cfe1ea51791eda044ba57b46eacae7be43b2a9f427b4b25

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b03af19dba51e2fc7242d5f3fa3fa17

SHA1
27f898a625dd2a5c6d44d343977279b2fa53bd03

SHA256
56647c4f99a68a86dc9ef64ae09f19ba63e3890e619464b8c947b7c7719c2ef3

SHA512
387d128fbcb427720baf07bea3b8921bad82150cf1eb520bf0a176c59103c49b54ef7a1075b54839c148d70e9cc6f96a68eb36e47d91e53239f58b6bdeb21ea8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8129865525f1e244b88660a981a628a8

SHA1
885842105b1c7581a82f50e40e65c8c0a9075d41

SHA256
3a0ff5cf43bccbac27daa5067703528024c0ffab2c1a71e92fa380c753c73e55

SHA512
091bb116a709aeb0632689ccd1bb45418a8eb597650bb9cf8f4de972ff0d1c495427d03d1394e6d8d5ae6a9defdcd8957888305c5a720d1f2b2b1100b8508b41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dac7306498ee8c8a314f138815f1ae1d

SHA1
fa3db6e91cf2aef29f1700a7cc8e26d5f71a9cc5

SHA256
5b90f0479e4f235e594fe665eaca518ac57e07a0cf727aa9be8551d53e9943c3

SHA512
7699f100e32848bc79ffdb6c11d5838d90a194f7bca6ef0f7121c7bad7559c84e16839b26d6f61775e58ca88ca308130feab71bfcc54b4bd40fff685da1c4a61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e28b20f35fe1b6f9bfef49bd67fdc72

SHA1
0d0e296fdfc3c20243fd5426b36f364788bf5f8c

SHA256
0d22fb80d071dac7d268071857fcb90d656b7beff557317a098cd1e1e9ee777a

SHA512
31bf7a71b75dd686717fb90b92d60b167b241c37d552c3451c3b73ff34e40c1fbd5333870215d63d5c4d096150f6b59859ae2e09c9b7df36c24a615f6b8a30a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
150ccf604d643fa589507469ba5f0c7c

SHA1
245fbed69f008f571d2b03eeb81e490cc50d7a59

SHA256
f35a3e048b4532fa97fbaf7c59ca846977cfaa2df302658d480989b35ea3a054

SHA512
01e7d27650f9d7494d6de45134db3801a7d8569c324ee910d8aa6c2ceb77b73b35fe87ef11d36c96d2cf520d7c4dfe3f43e18e58a31e69fa3187c661f4d9f99d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6XUZ2JLF\upshrink[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2500.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar25A0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit