ea92dd90a1130b428b23278ad1e08301ebef661bcee202708c10223ab6e680a3

Analysis

max time kernel
149s
max time network
141s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 15:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30a0a649d5f16fc5dac49dd3037baad0_JaffaCakes118.html
Size

38KB
MD5

30a0a649d5f16fc5dac49dd3037baad0
SHA1

b438834809ca6ce4601499d2e275cc300c1259d8
SHA256

ea92dd90a1130b428b23278ad1e08301ebef661bcee202708c10223ab6e680a3
SHA512

65450f760dede2340e384ac68f3a753a340292b1303946be54ed432ac3adec0e3caa02c61a51b1d1bb8f39f2e87d33b53ed0459d8163eb6be15ff24da0270913
SSDEEP

384:HjpHoB9VEsv0Rl7X3BqU1VpyFTrzd01KIyBLDZN6ANBVSILVfIRaGiiHm:4fvCljoAVpyFTrzkAJYTm

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ABE08491-871D-11EF-B4EC-5E7C7FDA70D7} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434736567"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2860	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2860	iexplore.exe
2860	iexplore.exe
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2860 wrote to memory of 2832	2860	iexplore.exe	30
PID 2860 wrote to memory of 2832	2860	iexplore.exe	30
PID 2860 wrote to memory of 2832	2860	iexplore.exe	30
PID 2860 wrote to memory of 2832	2860	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\30a0a649d5f16fc5dac49dd3037baad0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2860
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2860 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac1dfb24a2c36a375900db7b8b922f92

SHA1
6cc55ab8aa895f2cea8f98da5711954f6a7e2b81

SHA256
783de4345f601a1cc3e3d161ee89501f4f2feb9d7d706c84f2a7e0e1900894c8

SHA512
cbc04e61cfcee78fdb8b46a1217a069c435e7c3d2fb4cea29230f69877ee4cc6229fb6855c00817721a0debf08d23528087c38f07aae19c6a8462c703ab6932a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c40f89d8bf012e4a6d9b5448b610ae5f

SHA1
6688a8abb437f318338f151faf92655dd9e1d9ec

SHA256
440112b6ac0ee93087152686d9a4795c2704e7106e054feb7f906dcce9de9f23

SHA512
070140273ecef02d04bba36ee8448eb54a6744c98fa08b5e5f845c8928f11655a1148bcd553a94659b52a86819925f766a0672a8f22ed511ddc45e227d6bea29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78094305fbb1eeb59aa7ccad9d6f683f

SHA1
e42112978141f83ac5fbf9cdb2d3b2ffbbc99e90

SHA256
85cdd548a6eee6c0b6646a8bc4fa16b0d305eaa8516c7efbb6ab4170105498d8

SHA512
ebb6d30923a0ddd576be29b42a11fc04f2c78a144423f530f683339a1e1fa0c0f185fa7dbab08c599ffd166bd7f7780f7c675e449676f17d6c3139d7881c67dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
674a0538102ddf86cc172c4e6370e6f9

SHA1
3ce984c450b287cf5273c2c2f2391e3b7e3bb139

SHA256
8ff8884507729038156e81a342e3ac2f6c84a4f3fb28a0cb48999de6743cfa54

SHA512
eaa3a73bf547e558ffebde1270e6ce12ab1a98587f18002e0bd269829398d9baefebddb61334ab1622fb84970871fb6af1c5c58f7ae3c807f9a778b37a8db2ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c51257741142024ebb8a086101ce8f5

SHA1
2ba87aac6d83026c8ca13a81401f252bd1fd349c

SHA256
af3f1a6da017069302adcae1aded5e2c5330acf51f656fa4e5ddc2d740c3fdbf

SHA512
dbf03fb4e3e2aeb11bcb8ede39ddbac83a320faa22e5833c703250b39484bf4d7893434a200c73df27c7a7082be51865c3ec5005207c11cc5f47a01a60ca5b70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05dd508365d4b423f66f090bc2150771

SHA1
bd018d882e46135598945f1c28402dd58937cb6f

SHA256
bf28aceb5c49417c9900cd3ff7c2a779cc7a2f8b1891988008f1add814d3a361

SHA512
db856ee95a1eb27d98909931c32bd067a350173fda91082cbcf74b546694bb9b55728fa68cd7f323536c466a3366ac49d3fca518bf334675aeb1f1307bfe7240

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dcf68bcaa6a073e9dbdccfc714c61640

SHA1
dfe7a1e92f985dda51b400c5d6bc69993b70f62a

SHA256
b29a72c49cfe3367b040a8e851ef00e9181806cd221cbf55576a570cfbd029ae

SHA512
ffb10d7ebb5b707d66beee70a444860b0939b773240384d37339b4e3efe212b8b35a7944225e68545c9a51177b0d23c810566c692679741d8c41245ed3f384f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f80d523f0b34a9cf86336971fd67abb

SHA1
7a43ac1f0326c31fcb354689ae91572491d4dda5

SHA256
da09013ae55d1c33f35efe9a5c3d20533772d6cb32c2d1ccde66697feeddfa6f

SHA512
66a10735dc2ecef3270c70288e29b3acba4388aa98d4e345f1aa1431620397ec14c50d2d83ac523a9c42e2f8b7bff959bd4ff038c1c9020c39925df485b6b3bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a3afa2f1702dba39cd360f6fdacda9c

SHA1
cb35d02f7930da729f9b0ef78191a64991c51a85

SHA256
b2bc19198409fe18fc96b1a14649b4e099841bc04ca80f1211ea573413773e53

SHA512
a9c090fadd8797c68726156c756bfe306ec8fc197c092ca5034ab5dfca6ac7c44fcbf611d470436bb39dda392f6d1fc6d25b09ba219996ec70cac890bdc24e9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2C1F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2CEF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit