66f35cb1f9f9f5791db3070ad01fdfa3128f350dcc0fded33a1f3c212abdf33b

Analysis

max time kernel
120s
max time network
130s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 07:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2cf12a661f459986aa9dbe97efe89ce6_JaffaCakes118.html
Size

175KB
MD5

2cf12a661f459986aa9dbe97efe89ce6
SHA1

11bd56e44f8d6eb7a656071de745342bf16323a4
SHA256

66f35cb1f9f9f5791db3070ad01fdfa3128f350dcc0fded33a1f3c212abdf33b
SHA512

9682191952d8b99042964afdaf14f3c45f97eae3897d6e02e072f5758148688d5ec3404832f6d0b41b5dbe893a6259dfb0ee4882d31e892d2f6b80b6382b0ec0
SSDEEP

1536:RFWbBLWdc/1DDhArYzzjcO2cw1tKAyF9pIyMBqh4bC81RCSGY/9:RFWbZ5urYz3cxcgKR3pIyMBqM5lN9

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BFBBFBB1-866A-11EF-BDF2-7E918DD97D05} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434659718"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f542000000000200000000001066000000010000200000001755f326682d645a4fd53e3f52bbff7031910938343359f53993a0cc125a57b9000000000e80000000020000200000007e40cc08d1509fc47b20484bdede928d1f747ae6d6f95d493b8652be52383c5d20000000ceca666a7c9ff5530278f5876caaa771b581e6573d8be09fddc9c2cb90d2fb6e40000000b6d067bdd863033192a06aab74d3f8d7739848926386fe3ff943f04e57e621ae88f11407fd48fdee54103b5af805811e392e5e1ca80ed83685697174258dda10	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f542000000000200000000001066000000010000200000008282a7f66786fb96d32dbc7bc3f6c911ac8fc38f9631fd3086439d0197889855000000000e800000000200002000000037671ca3d2e8670c7d61d5d85f6d5df4b6f9dd37cb54af6655212c590d72b07990000000383c3f1789ac987a2514d4951eae42337a29aa4c995087701d2988bce37f99d3954bd65ededb7618975b37ac0a9548855c1629285398e488e737972e94173545144406d60c026ffb9486f707bf2ee72d6655650d0cf8034df0bbfc2d131c104cfe703129a9f929c32ca9a23a491463435553f7a517ecbf85021bf5d4195bb2ad601854600dfa17ff156c0ef77150f423400000007a3989ad830a90a83701b0eedc88edff9713857ae039d8ebc845b863f258ef49026fd8f3383e26708ba1f83dd9bc21638b8b89a9ea8432ad0556239a115f6599	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e00cc395771adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2616	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2616	iexplore.exe
2616	iexplore.exe
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 2316	2616	iexplore.exe	31
PID 2616 wrote to memory of 2316	2616	iexplore.exe	31
PID 2616 wrote to memory of 2316	2616	iexplore.exe	31
PID 2616 wrote to memory of 2316	2616	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2cf12a661f459986aa9dbe97efe89ce6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2616 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f479e3927c23682cd002e0b237e099ce

SHA1
6e3fccf34a381a01ba30c7c2a931ab4949836e04

SHA256
93da89143f1ec270c5559faa0a1a5da87ce4b73a86a2fd414eb62d0211321e79

SHA512
d5d62981fbfafd2674cfd1d2952f619658a088f61cca900d3c893ea3a8985e2a4fe3dfdc49f296fbfc6224c478b08bed0e570635ce5e13d21c1b151a652ac849

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bdeaab5f2a04528ce2a2d576148d2f56

SHA1
53743cd194d7e43ec961e40147313bcc971d23a7

SHA256
17246f08465230a9b154da4ce4fa0a4e8361305956662eb90f08315710930fac

SHA512
e549222315a8765e67f333830ae0c6bd6a1d72a2312d5a3a74d967d003088eb5e2ad48c81c065af5a5ea77f26c5893aa532e6a54ccb42378e3275a00edd39b8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
efc5e49f84db076c4f030b9bf9180c06

SHA1
96ad89848f099f2140674719b92742aa62ee2ecb

SHA256
e454803340ed725aa009e7c3dc08a0a547ad9c979d1b617634afc85f863a3eca

SHA512
c18c4ee7d8f1bcba431f2b7c22c3ed940ff67e055947124ee9a4377f591c22e0e384a86467985a9ea289ee22a8d1acbf8ba2a0ec06199c567953614020fff018

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92c311660ccf490004ca1416f6f0031d

SHA1
59cda7d59b1e5ca6318cf43daba438d16cbf386a

SHA256
cf09baf55516b07f247f839528f7cc652e957791daf89078cae52e5135f49397

SHA512
1504de2b62df702156cf770a9f4d25b3f5bf937d3ca9e0d3711d853c591842f2c661f7f01d66d4ad0f3c8e783279b3ca75c43b73a30072ffde39e6383b80f3dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
316a6c495ddb7a575201033e7069e845

SHA1
c0b9c9b4a7799a62f59fca6fa2310eee7c4b67a6

SHA256
13d5b55f681021237508c251d2dcd0662a0c3ed7e7307aa02be34212e37d7c48

SHA512
64a46415e21eb0ba283f321bd6c0d031065d0197ef9f0bdd1bee31871a2d2c1e03c7031d834455b33a7883ce15d0e0913472d5375a0d3fddab17896b8d1b0337

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec7ec1ae56abdd710f7d34fc156eaeeb

SHA1
ffc038152c44f5bab4ff1ce5ab62359b5e11c1e0

SHA256
2cda165a3f82021fef4d7f74612c09adfc874dda07f738eebf0f1a19a42980c2

SHA512
cc08593730d899be0b97f36043a440c9a85061883211312ae55ae36af6867ead3031d3a84348895a8ceaceae273e68e9ac400f8a43f93d190161c7fabecdb0d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6691639a96d92aaf36ff8bf0ad818098

SHA1
d6d5faba4aae9ecac2bd4ac52b4f1d1401040b8a

SHA256
42a8809ddab71acee6536a7a5fb8941025db8fde3c09671e73b9c90ca03afd1e

SHA512
c52a36c7b75aa13d3fa6b9783f3d2c28827c7c1de3615af8ec92fa70df0620abdbbc15b321a2222e2db179449a16ab7b585071a4e33ecd80ad8dde45ed587a02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3ca3d3c73f649bd33484544a67ad298

SHA1
4eea7d129552985651399a9384f99e0363343ff2

SHA256
3724e994c66dd507aa1d8829ca5c012ebf5e8d8e137f4a63177b24c864dadaae

SHA512
182950c10575787e5fca792363eb6ed1dd11e014563d3da066b1205d9cc449f513bca533c23c5e3e06f7a76c474a939aa4fc97687c0755508be894879a910ee9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
848f2fed2a6ef3dc815a3882396a8da6

SHA1
de69360471b83e611901ac15db9d1b5301233615

SHA256
9ebaaa6c9166752cd8452fd31cfcbff34a497164ec0640c760209774d10ccb4e

SHA512
f24a960d4ebf3486f1a2c119a215c43eec73b1a85132b09e5b060743c1d7c6cb5ccb7b285d400dcd4dbd9fd905e277c3c25f4cce2b8ec20a7bc695f902966bce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f710035a50f8a7ab449fd61ed2ad3e8

SHA1
03269576f66c3b4396fcfefa152362570aa1fad1

SHA256
797c6e6cdbe78282bc127640a7fb5adfcfa6bc128dc6c557f9c2b8bf245e33c0

SHA512
85a42e1bce39335a3332cba7366dca6a747566d2df14be6e0b6a5f426cfa3bce3f66bf9b5d77a301c0a618ec092ceedcc3a2a9dbf427afc4a56c9ea45837906e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e51abff18ba4afbaa2dcc2daf4b4243d

SHA1
fc4176dc934691b9c3848c3be2b93059f1120dea

SHA256
366b56949412c8d847456412399e2e6e50024c66ed9b8b59a4e1c23bb9f6754b

SHA512
d6cad249af6ff2164cbbf2d97f0f09b1f0623e4234e49499902984fc5260cb8faf4acd1bada0ae24b01926dc32c6183afa2dd28ac1312ea7eacefad4c706b4b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
afca7654df2f5b375e8e9510ade6d1b2

SHA1
3e6fd317e0e4f40bc2ab2d01cc1568d5b33b5a76

SHA256
532ab2299661d18e486e2019884831b17ca5e4daf7a9cc368a0cb1868192de97

SHA512
e3f77ff9778c694df9f8ed84ba3df832229ade0af5681c01d3179adf023fa8944a232fb65711495ae3c0207a8469ae6cb8e2b7b5551c25f98d3f98bed99db879

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e461b3f81f6e3d5c0b4062ac169ead1f

SHA1
8eddd2d80e7f8a591f3a99cad3bd2f0757ea416c

SHA256
b663711636d94a99ebeb433cca02b05379e908c9fb4ef85e4ac66f15b232f0c2

SHA512
c1dbd2bb1be8ca302cb022260ece963937d9a6ed615b11184e880315152050d2f8e8dc18d1f3ba284262433f7983fb3e28e484419c97074e96ef0e8592a2a3cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b21e93f75e3413acddb5205822615d9c

SHA1
23d70af61e023864928efc450cf1b88a9c24b98c

SHA256
db00263d4329957321553788fa967f8c013534fea9d346b01aaec33c96b5caa4

SHA512
c53a69638adb28fe2a124f89bd8cb8a98c2b386b09e286147e1e73f7c9ccfa5944b0b049459efa9086e74a917d8b333c6c1767f5c92cc79baa21abf6e4bcc36d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab235.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar296.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit