6d161ec811d0fa8bc274956bb9325d31718c7415a996575d105f3e6d40797308

Analysis

max time kernel
117s
max time network
137s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 08:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2df1fc83bb6393b698f6c69e4f454163_JaffaCakes118.html
Size

10KB
MD5

2df1fc83bb6393b698f6c69e4f454163
SHA1

ad3a35d53df3a41fa6be394d5148460b1e85a90c
SHA256

6d161ec811d0fa8bc274956bb9325d31718c7415a996575d105f3e6d40797308
SHA512

46d506322b658f7b0a0bbc6cdbf0491baa23710ac6762b21392fd864e1f1a05307830b23a6b9ae83b6b8f90b714652bf5834141044692215b220599a1edcc8be
SSDEEP

96:uzVs+ux7YrwLLY1k9o84d12ef7CSTU7GT/kpWps3HKaU87Xh2p/UGUZO7Xh2227a:csz7MwAYS/CaoCsZzPHb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000351a845190035088c54afd204c70ef8f1a6952793cc5681bff5dfd526a10a9b2000000000e800000000200002000000072610f245d545521cea13c6348dcb6df12c6c02d3b4fcaca44fedae346f84ab6900000006b6d1526fc4b01b0145c7005c34fc7f4f91c897318b3f75bc0e38986086c606b01ca55cacd26296ffcd98d4032ca4eafdd2232a2ebac99a32e7c00fe7439e6ec5fd1e301feba473f930378b6f398c33cbd32db9fbf79415e7fe98b7543add2d218f1faf66db5203c7655999fec8b231902f29bbdef60d89b3325a41c1da68cf49e46788432e829a0a5304ad4d985740c40000000ceb775a242fa5e4910252a00ae760e732d3c0ca5f9dc37845f0adb80eb9b578d85dec8dfd2a242d90b73287b550f40da1b753a8094525e526558f7123f0378c5	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434667232"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3875FD11-867C-11EF-A0E9-C60424AAF5E1} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000303eef0e2cd1a9499efdd285a56ddc5000000000020000000000106600000001000020000000789f016556583883308ec37b9c432374c147306824c1c6f52d6425fd7fa70696000000000e8000000002000020000000786e6d70d3a0e94ca3e0e213546e3f01c65f33906a943d6070406844a2e05d9520000000f50cfc1f525a32ccfe52ea247ce56e2972324b7b0c815e122046c66174831e1c40000000e5b34346eef5f5757afbcda829507e5d6a2826bdff529a2f8ad3cdb2c657b4f4b7132a7de401f7659437d4c4c8b60c7f5e7c0b184d257cb8ee0c24ef75653f20	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c06f090f891adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2096	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2096	iexplore.exe
2096	iexplore.exe
2228	IEXPLORE.EXE
2228	IEXPLORE.EXE
2228	IEXPLORE.EXE
2228	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2228	2096	iexplore.exe	31
PID 2096 wrote to memory of 2228	2096	iexplore.exe	31
PID 2096 wrote to memory of 2228	2096	iexplore.exe	31
PID 2096 wrote to memory of 2228	2096	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2df1fc83bb6393b698f6c69e4f454163_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2096 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef915e0fa0a1680b653aed5be072f806

SHA1
993911be2a445046c37e4085e7afd578baf2f26a

SHA256
ac0cabdc96d504e7626552d9019a34ff6c6b459869d273500b730f4352e2d44c

SHA512
fb91bed376786f200a6ecf5435a7d1a31a7278454c84bc2990a0facccc7f893536e244b75becd0ed4bfa4af72e33f175a7e34c6fce97b9b9fdefdc8fcbe982a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
070eb74fbd0d903e3bb6fe3e281a8871

SHA1
a128b434fab68d1a6d52a9d0faa578e02cdb90d4

SHA256
9bedf9c6e99ffd67b5e3209666d992c7912e7fef1fe3ce423a0ca2ca2e576273

SHA512
25a5f19c753376f60b3adcef1fabe588f4f3ecace5e1b62340a981d9f0a6b7446aebec4f9d2afaf3222bedab976e237b025e90b2a33e21fb44e1ab4dcea72d62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8685885c21fc8ad54d0260499d1e3191

SHA1
60d420dbf394dddfbe7112522dcc2ab7ac96114b

SHA256
8f76177c5cfa28b5a259fec9cdc0542b35c6ab00873b5e52772583c3c507d569

SHA512
d4c6445f8d857bae37da336182a10968b4481ddca9c0fc0e4a06781fe64adfe15696bcb7e813ec640ada95a55e01cc7adbcd34bcbfe7b49f6407c1456b60c103

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a020a683b02abb0595ce9b6ff209bc1

SHA1
68278644b4ba4e73776e5bad7064272d59a4c195

SHA256
31b74d883cc08d4c153c7c975476d8ccebb159bda5345c014003eb068d0206cb

SHA512
2d76fbf776fddfb9c245c0f8dbb7cdf0ff43f7899e510733a22b8184f778b034eb075a06398ca7c872ad8ee3d0ae8b96ef921e15274cf044b2a82b5ed92002ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1e314ce2f9f873268abe2b0d05e3590

SHA1
5dd167617981d1b428a6730092a37faf433a355d

SHA256
5053545468f15e70ec12bd219a9830f7ffb29e5c6c87bf43eac36315cbf347c0

SHA512
3adeb0bb00129614f95ac0306fd2f93e45ea414baf4e4bd0774b8c4c661d3b703111994ffa760575e5341f636a23bef8bc523ff0d5fe1ee1a4eb2033ed331153

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71ef528f09aea9b2e639cf68085d3c63

SHA1
cae6fcc13620d98852bd7328f837aba274ddafe6

SHA256
a1c66c03bd07dcd24b6badeb47ab2d22a0ca21d9f8589b70f4e3d33e1dd72bcb

SHA512
07aa01c2e81893403f53b7725b96b9f3298a66eb85fa0d122e020900a3a6b7721cc9e0c39111071900fd1869fb1ae53ea1392a3649badf3710eed0df01ccdb38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f44d6cd567e4ed8a6fc8787b8500f113

SHA1
823d9b9b29474b9a0d1686ed56e0c0eec9d72b9a

SHA256
b75429b8618756832b8dd00c34d26c06b45fd726f997f6aed29bce3b3aac13c7

SHA512
abf4261033c6c830ff5f95e0010229cd62e0387fafcfb54bdb3e0980b065ead9bd1b5390f89a5c8127b78926a2d17522b3997cebef96a711cf4c840a83f58d00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d1f808d2bf5c785e63a54cb0123a633c

SHA1
1bf6b03638a702bc3845579243a6984015be8b30

SHA256
e76c25eaa68e57c89a52d57900138afe0811c4cc45d0ada39b1d33f5689d1d25

SHA512
d1f1add75d72bc75d1306e1fd02078a29df2ad4e20f0d4d28537cf5bb52a6baf3013592d2d4bd77b2c591d7cd6359b38df4ec40c9c46d27f6594c2f7b0882352

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93f693672a1aada25a730fb9cf0a5c13

SHA1
2def51c868f4acff034254ee1dc01dbccc00deec

SHA256
e1d4604b1e0c58856cd85d7f237bf2b11d25a5454b1fc4adc946987d3b28f36c

SHA512
e0e9ffbfed069bf63fcf8c256d0f9afaa1f8bf27b9f9fe851e85e1c78e3f52d9374e72a478c5a07b77cd2605ff76f60cf504d0b3f7125e77caadc5861d457291

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
486dfd80137963683a5697e85c268813

SHA1
96b305c58c2b4b3c22994e784f64ad86fc5223ec

SHA256
3371f4d2e2fbfadbc8acf9726a84537220b6d1389a2007cfb087bc996c943dbb

SHA512
d78384a530418ca2d8860c8c129a9a2fcaf859c3f2afec01fbdd0bf17dbd36048cfed0f42e0ba0a676bd6b44a6e7e216508cc09968b2c3ad438ec30b0e80a504

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d48d17107b01971e2e4bed84289e0a26

SHA1
5429e94f92e5f813eea9523603daf4e83e397724

SHA256
230896a517003fe8199065c8d653948bf9858b11d4096c7bbd0e6290fe19e3c8

SHA512
aefaa9a2569906da2a79bdae7b94beefdc21142f69b63b0a877c9a87dc3ee28f69dfbc69e7e3fd0102b274b90ab2d53e6739e4fef87c63283638d54e121cbca6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bdb641ff86b9e11db30ba65cd136ad82

SHA1
23d011070899eb0d98a0fa6500f0472e67a89da3

SHA256
17c16c5fcc2cd6ee25fa79bf43971b79bae1f6fd3155e6a93ec2c45a1287409b

SHA512
15c1378fae306b6c6a1d28815519a17c97a18c1c1c36f386f7a7fa41a35abc0e1c71a6406857cc640a7fbe46343ed210779e0582e0367a141914dbf21ab1d240

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57fe52d9395979133f0e654860e215a7

SHA1
ae3f8db09cb598092e7947d92218b0d310e6fbd6

SHA256
3aca4ecb948cd4f0f61e0236764ff561d9f432a5e877cb3093d982051f60a37a

SHA512
40ecdd26e8f2685ab1c36175f4f06939a08c880746203c8b5c6cd7f61ff4a8f19ebded28572ab3ae7868b9eab9fca110ad65bae64e1b58fd4999b26d508f4f0c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d93a6dc1b2f263d4d46de4790760e600

SHA1
9a8a09ef421d47fffe226615447f9beb33e969b0

SHA256
8e6f5ce40846ea97f08d4bcd60af65d120d32926446491c5a49fed3f5d70fb92

SHA512
ed2ee82fb536635304dc0bf1bb64d8c8ed751fe5bed813e56b78661d4e14fc2ebd8078031774db4281036c18ac7fb6d21877945c80fddf0486430056ef51180e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc70fe282083c55d77c86e0900ed2719

SHA1
664715500fd7cef03a2988d1a2904fc25f1c590c

SHA256
1871473c484338c58db543a7c8ba0e506dd5edb2b6fb411527992b40a6e9e8f8

SHA512
31df966dda483e76a83c7e762c5207a26753c747d91939ee986c4a0bb80d3d7b9a27ca1f5f41910d0adff6f8fd122bba6c0bb4976c660f3d9c9a761957d905db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e668e4fcc0d03bf160943cd452bac63d

SHA1
657bed90d840579714991f71553390ee5e6c5da8

SHA256
3727ac435d29d5b4f8012a9879bdf8d979c73d29cff97d85af2ca01b67706f25

SHA512
ab7d5f0e460ebcc6196d41d9d194ff47e0305f903a97451ed8cb147dac872149dab2233e63f2eb5a31d2b3804826d18063df7b6e66e478d057d69b375533a3fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF336.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF3E6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit