0fb96d60bf4a50892ea6a4067b7570e8a98edaf063d52a4a6a92d1e41324775b

Analysis

max time kernel
138s
max time network
139s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 02:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

29278769dfc0605d122eb2ec9f172c33_JaffaCakes118.html
Size

142KB
MD5

29278769dfc0605d122eb2ec9f172c33
SHA1

a8af733f6cca809b48d96533c4602391a781443a
SHA256

0fb96d60bf4a50892ea6a4067b7570e8a98edaf063d52a4a6a92d1e41324775b
SHA512

72cb4812e1d0cce013f1f4aaf8d5884a4d519d183477aca9635b97d5cf79665d0dd99eef61569422800ba271e961481caf3f1e89bc15d1647740bcdc82e61993
SSDEEP

1536:SNWd1c8h0Gi+x76vuyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3p:Sp8hrx7dyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{089EB7C1-8628-11EF-9BC7-EEF6AC92610E} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434631065"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2076	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2076	iexplore.exe
2076	iexplore.exe
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2076 wrote to memory of 2308	2076	iexplore.exe	30
PID 2076 wrote to memory of 2308	2076	iexplore.exe	30
PID 2076 wrote to memory of 2308	2076	iexplore.exe	30
PID 2076 wrote to memory of 2308	2076	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\29278769dfc0605d122eb2ec9f172c33_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2076 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
233e740d47abc87c44d2c3667a55965b

SHA1
2c04ffbe7fb714688da50f35b92e2faa4c71df42

SHA256
6f306bbb506ad3bc2c5d94041e84fa4e825100f9b75b7efd94a297950ae8e1e3

SHA512
c179308acf9a185db666fc7cd6417a1853cfe3d76898fb7a8219e26a112549bf41c50e1ae37314687e32cca1a00468afb4e656aa354ad05a1062713de7215456

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1873772d5d8b9cf1f7759b9ec57f2e9f

SHA1
9aaec28d48773060c9db7652cb768d2b9aa46cd4

SHA256
202da04020034917676c8029b179e498eb9bd0fbc2522ab3ef7ffe7348a919e6

SHA512
bb1a83a791a1410e83f628f5b6c1f5f0de65ea313b822a1882d56ba2961a4dd88d3b1c3a52e759b4792010674ee9ec2e31de1a33ccaee58306c1f8923f7c8bff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45467e60aaad46bce86a072579ec486b

SHA1
54ccc8b5b7efb9a792dfd5241c5a23f122c280fd

SHA256
6b886426bb03d0743475cf00237b172b13ad9eebd005fa6096841cd51e558b4a

SHA512
ab8613861dfbf3f6604fa6b84d37121d63ea964f71b79598bae3878f57a2a2ab4ae31cc6abe56ecb3a166a6c39322dadae32fb920f949d9f46c3bda4e35c0cb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8077f889b4c348f26c19e36f3e835b7

SHA1
cba05575736838b69c53a4043e39b8ab255c10ce

SHA256
74285de947c06ace2e4acfdccc8d1a1819476e123036d682a3ccaeb6a6fbe5ec

SHA512
7b75131d7b2251be21bd67195457f41ddd2a4f53e50c463acf05a2206bd7dd05447e3061ca1128552f579b765a5d891d084b30387792ba1ca0a7f622d0e51f70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7540e30191363f8ae7a815e54ed789ca

SHA1
0f7f44eeb501000d6088aff9f954d6bee3db79e9

SHA256
10f35d46c47befd1a4104f1791efde428a25bacca28b25e569d6531559c9162d

SHA512
6fec6e30cb03c6929938b8398db4e3ccdd32d4f28a55eb5ad43ff9ee5aac0a763e7d15d774eadb24bea8e61fdefe8ce92c9382f33fe206b4bcd50311578cfa05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c31f8b1e8357284ec6d10f767238eea

SHA1
ea6cf62ca9f33390d69f855e24e600faf34d92ea

SHA256
3927bc1a8f4a63f119cdbb6214cc269229188c74dd7babe234c5f1103f406300

SHA512
d072729527f2571ec43a716b1955abc8acc81b67ce597e7c13b2731d6105c4816d59a29c1b615b6b39d75e5184d1db7381f1c7c1dad53028c3ff373ddaca28bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d00dbcd0c9e970cde203fcac3d6a888e

SHA1
5fba2546412054d3e8692724258ea3a6357412c4

SHA256
28d773000b67820f7f0599a788d757271e67f9b93a503edae1287d1f17086896

SHA512
2dc241d15e905fbf4f1f0f59e4789d52bdc2e360d3e2932568820116cc84c55fc652d1786e02d558abbb98093d65bc0ab0ff0f613a4e262b0557dec4b1f842fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39b18954c570a9edc8575c36eb9d6023

SHA1
c0de035dcf449f134484f1d3324434ecbd190d4e

SHA256
731b7b440b7d721a7be1fcb6c57448b53cd892de28fcb3aac482762fb1e884c6

SHA512
8fce59318b54474538d776ff66a6c39fa0798d7ee646b9175885f941f336511dd1c91cd79e183726cde76cf91d5a0cb35d7c111100f7e658808d97c272b4116f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22c37a17f0d358264f44b2132020c3d4

SHA1
3ed7b0ac9e8bd1d9b898d321517f8fedc48479f9

SHA256
8837ca31638ce037d61c022cfa9ff5cd2e38dd03d378f414b96eb42c1cdd000b

SHA512
b728e6ce9331e318c77758de54359b22ec75c1d2127ad7236d98afaac098c33eaa3d7b5dff8695e82101764550e321a11bc914af8accbd513e215b57c78425a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b733f4172247427ecdf7b8f5bbe7db92

SHA1
52b1b46626e9e5a8e16ee6fa447c9c82d224e0d1

SHA256
e37803e5a446faf4150f3ad7c057e2927fa7cd4852c14b7e679a01235ac2bcf4

SHA512
7b409f28a1743fc8c24ee0033f499ec78c32f8fb2bdad660b7953394383957a80f3e2c0f39f0662b9662932d9816c93a1d887c3c3cb4387f69c33193884e6c10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad123004d548c37c7dac8b7661e3fedc

SHA1
1525ebf4ffa43ec6c20b9a809d2035b2fa2a21f3

SHA256
60ff6247f4ff6d27759a34ff74c4f0428a26bbd681332c710b7b64b7a0642507

SHA512
abf7274d2452e522f3912fafed87dd32ed55c74f114d30784c0e1b9cd65cafa7e49d3520663ae31923d03451930f4534bd3b8781c47435c0b81b08b5ff096979

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a07df92d316a9a7d0562cf330413ade2

SHA1
e6d020bf226604dbc6125dc1f7b0c24e1e6f7d0d

SHA256
38547ab46f036f5d207e6d8278fd8adf75dade9e4a8e77e7580d232172a29b1f

SHA512
7fd510b403cdd11280a9d441778de8329b9e007100196f80f3e730b5aff520049260e7ea49d2f1a3f582d19301353d636c51eb229f87f730fdc6ac10929f1f06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b8dcf2e21f6c5e8f2e59871573b5b14

SHA1
ea2dcbcfa722d119430cdc58526efbfdc6b12a10

SHA256
497ece08aaadf0ef6eab93ae45ff8586904782d19466a1c20d5b3b3d4a7e4b80

SHA512
3f2a1fa2615f901e7005c6dd9925d02165db764afce83994cd59f1b59ccaf81dc08f653c7216f3d758825f2f737555737cb4515cfa50d459c0ca904deed53020

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fde4473a3709230afb3a4c5b663260d2

SHA1
3ae502085615561ee56cc0d1c429f60546811c9e

SHA256
8b225e6b6f203fa3278d680e761d055e917fba740f6c6573ee7ca44ede5889a9

SHA512
787306e3f796b76b256f02726a2125f9616c595e83da2efbb7b9e978facf92a5e578acae3d34aae456ea34ecbd9c560d0b1307d612de6b729f5043b697b5b533

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6618dd6fdf6d0f53575aafc4772fb486

SHA1
81787e4d57fa8c2d9df2767eb59b610d7ade1a22

SHA256
9a35ee31c11049dae51905250a1333e7e54019c3f87a07a9f9f1a5ec780261a9

SHA512
8932c3e8c7824a1f64b6ac25047adf41cdb542b5de3e742b2176db60fcd169a36bdefd56392524e1bb41cc184304c4f549011e4273fac335e0b4401f6b26daa6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c78f7be11c006117240f19fe9008fcc7

SHA1
bc161fde52c12dd4a6fb614fee7493b3505beb12

SHA256
a1f0eb6c9a9b59263f010ed7a60572f1c0155d5fd698b9e86e979f41da35d972

SHA512
b7c2b7c267945b5fe0c4090088af3dac48879e87b0e8aec0c2ee0a0473e679009041322a0180f5f0a55d6f833475fda55c6100eddab9ffe20ce0ee0456af8c7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8fb9d416f7763815573778a513a94410

SHA1
5d4324d64ba71eb49302f0cb0bafad5526d3fbc7

SHA256
fb6365be5ccc3b7796eeb512171d3798e667e3ce5e52dcd07c13034a1f476782

SHA512
31a7ef87293709bb3ee11062aa5f4248ee002901d0e5d8cf3632a839a821ea086f6b3460eec521ac2bb025760dddb81bf0a070ed189345d67334f1b862ff7659

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23c49dd5d1c6dd2163eaf183ce1052d2

SHA1
d53f7ed3039019bd282924ce1764c726c672f1d8

SHA256
9a3fb644e0301f3c0fe8a9acc43dac852b0e8379afd06c3db82e2a0b4577494d

SHA512
21e930d06cf1b59b0733471074362590f871720b4d0744e3208949b5d4eaf6aaf3ab4b21ca7f73184a2c5ca79983c06830f78be56a20fc166fbfc149a8ce6351

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a00afc1501b1aa4f4a93226629567669

SHA1
cd2c094009fb99459640349f4556fdd2100d2f08

SHA256
d2a555c1a0c7d9b2ae331316e08129496e0d851ed2584a9474e8820463df0baa

SHA512
0d2057998da5e89ab2f89351635db0c7bde322d3df425c9f66a43b96c77c83ad1d2e55abb7e19d79f7c7db1c2c3f72fbe70d16ddbabe269dce84035d158cc8e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC0D1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC170.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit