8be9a39b09b65502696d9c3a83545acbea8f3397509a4115dacdb4b8a54fdcb3

Analysis

max time kernel
144s
max time network
145s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-10-2024 02:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29091737be1d279c82b3c1f47ed6e5d1_JaffaCakes118.html
Size

104KB
MD5

29091737be1d279c82b3c1f47ed6e5d1
SHA1

766f51d1c9de3bd20959ccae3d23f603797dd8dd
SHA256

8be9a39b09b65502696d9c3a83545acbea8f3397509a4115dacdb4b8a54fdcb3
SHA512

aae3328f12adafa12d5ad4f07567d4314edf63e9ce6f2c4616bae7548a7c47339df3e8d402e94823ad58fe110b3026fdd099f29b6fb429ae7733ca09d46cc438
SSDEEP

1536:tuqUAWQI9FrhqaeJge1MeBeePIxBZ4OVt6ylMdAfa49QpFl5Cu0O8Yk7RoGFdn0T:lUAWYdAfa427SlZFdTjFNKwv0mHVeksv

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9D002601-8624-11EF-854E-7ED3796B1EC0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000a5589c2d682b9952f797945fc859a49a41c3879d77f951c3088d363b49efdbd3000000000e8000000002000020000000978e4ac7253f953859aa77f8f290d9ed7f83b899130f06e409a4707eadd7184d90000000c38c3cec35dd6a47a2eb730dec9ba5d93be0e3b2deb78a9f6486a0d778ca7c2e6d249582fb45b4a63c1695c9254151994b67473c3a882a5421c3725abd5c504ec7819fc996dd08be19e2269a35c20a16cde6c82d5772c2bf8353e17fd480ef1f1df72d70fd5f2d91510f7bf354c4b1d0144449a2eeb6060419908d0a3d7d469ad4ad2828b0ce5a818d28aff0b093f3974000000087f0a6280ee3b56c5fdba381fa85869917b2975cbae1f0e7bff5274085ac87376ce418e0f668288ecf3b3a7a937c6aabb26fd0989f9f3195fe1b6ae0119631ba	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434629596"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000c3eaeecf880588392f2f0d01db21f788435967a8f9f769fae7ecefe4acf2ddcf000000000e8000000002000020000000a045af19c6f55ffe30fc03ea7cd884164cfd8eac20988dec0edf92ec295e32f420000000c604bb662a50d3789a924ee193f8e31a83c25f2e758ed030a9124694cc69974c40000000ae6f61d94ffa475990e0d3104ff86a34beda42abc811ff91cf1853208f6cbca2b01cb97143b8a2b2ed262dc56c4a07cca7d4c1d1e42754555af0980dd660101b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40e8edb1311adb01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
876	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
876	iexplore.exe
876	iexplore.exe
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE
3060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 876 wrote to memory of 3060	876	iexplore.exe	31
PID 876 wrote to memory of 3060	876	iexplore.exe	31
PID 876 wrote to memory of 3060	876	iexplore.exe	31
PID 876 wrote to memory of 3060	876	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\29091737be1d279c82b3c1f47ed6e5d1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:876
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:876 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
14df479989e352f65f040b8c8e262ea9

SHA1
157e2b472dda448a8b0f9c18d44c7285132cd73d

SHA256
97299600b5ac12e6470ee21320b70c60235d9d2cbf7c764b51a12118e20c6fd3

SHA512
07b2a3b2a0ff26a3ca5be7bb1d12f939dad0ac965d492786ae867a352c834787dd3dc9983f1025450ea650d38cb3e5d3f922ad3ef185642f03c605f57c4a89d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b820566c2623c3a72c51e2624957716

SHA1
acd639dcdef3fe7d92677d1e77ca179206c0db78

SHA256
dc6275a610abbeb460c4ab31dec50cef517f4615c214be9312bd70acac02fd4f

SHA512
6068279a7681491a46d234a4e8b78b218d1cc0debc468301301eceae052e7ca981d74144f2bb6fcd200f7f08c72db3b0c2a848658d7238120e2ec87b9d1b3fd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a267c553c10c36502e323ad965cd424

SHA1
f339bedf6d6d14cc646b3e63dd9be0858c3c1b73

SHA256
4fb85eaf96cb7a4753d9bab11efde8bec8a9e280deec99ec6841e100d0845891

SHA512
e9556c347a82b33ce46883e697d3a280539070c14172f3ff04f203254eceb99d338afdf8e8c5e952f48bc3293caeab5c9194c5642e914ae9e401dfbd8d818599

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f506d99bd3d5acb073f23006880b51c

SHA1
e14980ad82a7b06b3fe315a7797eff14d130db53

SHA256
79beddb3c5fbced6d5252fef23f491133c25f69b62a4375699d32b0861fcf922

SHA512
cdf98010bc18d61de358f387ce0aaa52bbb1a1a219b5940a30a024081695ca16eac8aef4591c29384ab4434714d62c04d95938f12478d9a013800ccce8a79214

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e4e625c7a639e1b62965460aa6708d6

SHA1
ef8edc3b70e954b687375a70dc94878b14442050

SHA256
e9731e9e4eeb2639c95df6584d8a9057d69d3f70ca379a64c7b2472b06f0c84f

SHA512
b151b090c1d97c8ff2c55e623a5dfcf1d154cd429ec98f7a8ba78c8b125cf7a9584cddcb34b634555b1b1a13f6e506c8359a912828bfa20b82a4bf98dbe19f5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
740ca0d032f1e0f59985a10c57f557e1

SHA1
d2a6939009b0a75d98f499274e55eda8233f94c4

SHA256
b9bc1f98f71b8b5ccb02c63f2ea14eb59aa642c8b667dd26cafc3f5b2dbe3c3e

SHA512
02e7142a49854962f20fb41d6a705744b363c75d9b8288e79eac3195f7336a5b2ffca04b8272edb439c0f2a2822a55c7396cb82f35a3792e4f812dbc71697e60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3593d0b5891e6704dadf59f3ff8023cf

SHA1
17ea7993fd3f7aef77c705010450893d1c043e6e

SHA256
866f0fd591cad1cb3c55191c5d58d37aa4deb0ce17ee6e02a3e3683acf62e32c

SHA512
1598deb7e2aebd5b7a41244b5f76d02c15192f76b3bd041169ad3c1041162b37bb3234a689ba26eb5fa9518647120229105e9e66717feeca0471f9a4a2d77f5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b2bdc174e30f32c138394366313d577

SHA1
e7a8d9a1b9472ddfa38edf7c2d00969929a12e48

SHA256
8bd3d28b8457496c637a3f4846f2e5cfc783e88162c0da750beea7e46562f002

SHA512
fa819985ed0f6c08de4691b8370a45b5cccefaf91b5c1619d42ed0687f546e074f446da531cf377317ae60dcf9b13a80a25c7e2fca53eb4fe059d64427142abd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad2bd4e9c4f4029707a623007e817648

SHA1
7031544e7a54df242f773b9ae53a425eaafb6174

SHA256
13bcfa02505d69bf3f6ef71a602eb8ebaf831cfe408d4cddf422a9273d5206ae

SHA512
7f4b84fb9e5b9c6f6216a920404673efdad2c519d8826a577c0595fa1af68b0d90fb0071e142a80b3a8efcfb9479ee30b780fa878586afa8e2cea94b16617e33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1760f98d699ca054427ff0b436d7fc6

SHA1
f727e1d931eb414f23f8c91a6504cf0c4c64c263

SHA256
4482cf33ea1d1ff9191d92738e99d923a903f40c1fdd8111f82c26963f550116

SHA512
5fc3efad4f48137899e1f0f67cc6f4348fc694e11879bf5c7a7aa5a34fedceefad50ed785b221b050590dd8134cb2c7134e4902ff7ec3024a1cd45c74edb570e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1127c6d328f5b521f202931215609053

SHA1
c939572363c1ae0fc1f8e8cb652c4945379d08f0

SHA256
d4b0bc196413dc86201106a47af65f09b9e00fd815fdff14c7e4c2e4bc228469

SHA512
0d5700c879848f0ba3dd08ffe6fd2660352111dc250d12867f8f1b67e4f69b60539c692896ab3bfc6185c944104cfe6832097d8faa7c1c626364200f14e4c167

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b11d3ed5a1eba4e3d49b67bf78dec091

SHA1
3a087805e78c0173aff103a0ce9a2101b4172139

SHA256
10d770eebb6b93223aba79f5d5459386b8073686fcd6f0ed57d40ba737ea9d5b

SHA512
6e835fa2c55a6e323fa2ed166fbe432108af1fe12b83281f0c61833c7e331d29c5487b3717371fbb60e3f3ba314d4d81f30fbb825c3d4e0c0fcab0dc76b51d3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
a727af681a1d5f04b42a080b13931b80

SHA1
07705438e0271c2c08067b20903675c1a1ab039a

SHA256
598bf0c6875fefe422232a0c503039463b435e0a55366209c7a2f25725e1226e

SHA512
cabc9fbe63212cc12d16608446a284039252f86f6e41de442b5769ec9bca63392478f6f726feb4c0f1ced1351b0eefdf27822766a5a682944b0296fc780ed9be

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD059.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD05C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit