c23873aba6d05802996dafa15489d181615c601f31cbb123fda37bfb496b58ee

Analysis

max time kernel
136s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
11/10/2024, 19:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3674ff7d9dbe8a1437e07aa5128c8840_JaffaCakes118.html
Size

139KB
MD5

3674ff7d9dbe8a1437e07aa5128c8840
SHA1

bde7bf047396d0f3c98f1aeea8f8504d4e1c114c
SHA256

c23873aba6d05802996dafa15489d181615c601f31cbb123fda37bfb496b58ee
SHA512

25a011244d975396d129fab630406ad07be963a693544cb49678804921a02312a7a6b4fd93b6c7216b42c355a16c66593b91b44ea601896c6428f8955df37e86
SSDEEP

1536:Smh916zCJNm1uDrA6wvo2telJwyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1o:Smhat6wyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20f28087141cdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434836973"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{73EFD9B1-8807-11EF-85F9-DEBA79BDEBEA} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000e101cb22fb6c1a6c44589b27a0081084d846fa6afbfd602797849926b836466f000000000e80000000020000200000001bf8c78731a9bc755f8f75df44ebfa0277d8f8d4ffbbdc5b5d7d22584f505fb620000000f7311f38a31a1048d9dd24663a5f97214309aa394ecee5f917546503ecf8a7b440000000b19ef1d1081c94cc526681455eec95efe44f52d824890bed23621a04c169302aaa97b5e5cf219226dfb91b912ef4921484524f2ab6f9a8214be19c91b52a7e1f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000b2d780f1f85e85c5a43788e51eb459d2333b4edb2ccb843a272634047b260d0d000000000e8000000002000020000000cc87c60ac298774d1fecf260d29e3d2ab6640b429ffc5e056808cfbdcf6b7d089000000038d3dfc1546f6b0796d238b592d9a9cc8f5f1e401d1f49577d3a6a7685b381af0fe708114e9f71c822ee676763177a007d72d6c99e6b466b55c019de305a8c23306ecdc2cd22e51d32703810fae9e22b524466e5a1bdba4cc0f08e9373d109fbfc939e748f687352448c440f721f8536c2bf4dc08baf6c1f51d7aa0670b3e82b622379385400e433173df00735fa472c400000009882392ddd55691ed6aca32c111ef2c258b55d0ada2be4aff1c7231bf828be546a51f094281e118dff1b5c4bad3a29c0ad6924617afa2c98462fd39e3bcf6641	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2188	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2188	iexplore.exe
2188	iexplore.exe
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2732	2188	iexplore.exe	30
PID 2188 wrote to memory of 2732	2188	iexplore.exe	30
PID 2188 wrote to memory of 2732	2188	iexplore.exe	30
PID 2188 wrote to memory of 2732	2188	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3674ff7d9dbe8a1437e07aa5128c8840_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2188 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2470cb37f1e9745f920183c0c84ff07

SHA1
3d76a30c683c803d8b9078414b8f9dad4341555e

SHA256
1140c305fc503bf0754d35591e6a2a65c4a4b042450a4c620440f1ea6c420266

SHA512
4c913fc9c4a3ce322964f4d13916bfaf13a34171a537d465f3354ca070ef9e82dd6ac39e2586df7177be3f62dd6b5b1e5745eefc6066ecaeb21311533c0da54a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62fb3ee03fe91c99096128bbaeee860e

SHA1
68e33b05faeeb77c783b80e7487a22c275bb3fac

SHA256
0b243f46fd683137648035697a150ec671ba225e4a24f1e7b8e020575dd1f639

SHA512
3c20a3a071ac6a1eb40eac64fab0b047adc960eba2e9f3b2ae5b2788420eb5281e80aec2cf694056f664813e06bd2665cff5a0833ce2f0dcf56459ea66748601

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8bd9be0b8b7c3488f4da25948f010a90

SHA1
e036f83e1f8fe314e663ccfcb3621188c465bc13

SHA256
89b3a95a03b28b1eca1c72163a9114b30df1c3a80d0369043b1d9f67ef2bbb71

SHA512
ff4d1b1df1c20cfe7c331053a00d3495d7069f12b5d05798d9050558e94f53cb87f5ba494c8d823dde84dc35ae18e00792126d702272246ca391366cfff2b6e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8a4c5891f414d00a1a3c6ba030de01a

SHA1
1f7de78b41834f84e7fdab04b23fc712b1fba424

SHA256
711eee12f12b912ffc66f8f5983e992d20e11e5128b21fcab42cad7f8b2b1ca0

SHA512
e4e05bb2d15360fa2625446cf61629b2d495b3348a448e413a1de94ac3af2c54fb655aa93d7f2b6e75b06a284d07ec005da893ddfe496d424f11ec3fd6828b08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca07dd812e3fdb282d2f0995e3bd7cd4

SHA1
d37e7f56ba18aca60483b4d0e8824a379ff3d98e

SHA256
4e7689942fb8c6a19289b823c9a600e62b252cda557f7c4ce889a4b871875a0a

SHA512
b12df4921853c82fb1c2c1e4f0f7e0f60bf5dd859066f492d832804d8dd3be4ddd74e6398bac38ffe229078ec76e6746ab1dced4b6b301078c258d62d68a67ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46a2eca80515562056d3330c88c927c4

SHA1
3f31eaadb4a7deb1466fe325f0cf1af22b16fe90

SHA256
e36e4ec33ccbfef5b6ba6e4630761ae739945cf38310d2b8e9c2b46837278278

SHA512
2880c6354c503c64a74e137dbea17ec2d527ff59da8ebae623b5673a0041f75a92cb4e86c6a8e7da426769957bde1c38ae6a1104ee16a96befcead5f4293ca12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ccb01d357f59b89997b1344f12dc4d34

SHA1
0d7a84be10472143b43107e42b8057e737defd0d

SHA256
815599dbb7cfe1fd97c5cc9a17e58491154bd755224f0e7c068e7d1ccbf934e5

SHA512
6a2f9e63738d5c8b7ea0191db7deb1a263005fc8271c217cc2848d847f8292e3813d9c9fbf8f1ee14ded2a1e6482be6312f13dddf85918936bad674098e2d6bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
87d9ffea34210d6942bf96831a8f6a81

SHA1
211f362edd3fca93384aee237c99979bb743c121

SHA256
319bc3aea5cad9b0e001542ad47a337f5027a0fdf7be35fd9a2a97eb02ab02a9

SHA512
659056d5c88e42837b5aaf541c2861fc89950548e062f0fc2e87931993b1bb1be4afc3473ad2e1e7f366a37f05ebf2651fbb93e0c4939537866d9da1c988e268

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0bd1d65e8398487fb12c9f6b03d8221d

SHA1
1ed20ef9bb4a32d082c1b3a0275d1182e45d0bbf

SHA256
8aa7f36384c7f594e0113baec2a983698af9a031e9b4487d72d22da6913d47fc

SHA512
220aeff3f261ce62ff495c3f1a68ef4178476c64a7813827d3b8cdcf39de7c7974d492465fab346ecb2ded49a072d28b7f0b7e91c4b7e2030aa8031cb9970472

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a915a2e2afb7c14c98a5ba9abe519044

SHA1
b46fe205eb654b1d1e1cf04e6b79f06ed304be26

SHA256
b869cf4634c5cc47c4441684ed75fd7ebdb0431466f7d39813a6b010dd84f5a0

SHA512
5f2e255ad8877141e3f8dc09f74dc5f9687251c4deb7bbf30e61e64c80d19b97da893157972c4261e088678469d02b39b735e48445f15836b0cc1ab1bcca6f93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7cbde511bd386172e112c0b04c8b5b1

SHA1
37a7099622a155e69deb925982ab03caef4b1158

SHA256
dcb94818b51fff5d9fc762ae54dec0e4fd526a93ee7da993e5d616af7b39625a

SHA512
90f60bd8c9bce400eb2eaad6c8b3b391d031d80246b257b074af2880bdafd865dee90aeb1cf7d3da8b17a0d1d595648198b2be85166bad7509434af4a28b2afd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4af5b692b16d122b5001b77329bbe137

SHA1
cf74af68a12e900ef0c3985edbfbf44554114e31

SHA256
86b352fcd48a4805dd2c8bf5409cae158f1015124c0c789321b2948851b48163

SHA512
cc14eb6ad02f65a39a866f84832903494ff9c9102b82d965363352d8bcb1d38046619e91395ffb2bef94842dbad50ff950a80c6081bd698b8778dd34a0fa4dbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff0e08b369ed7c60a059e7f2cdd679d3

SHA1
c48a57ba75f0aaa54b0f7a24a6cda9c5bfc3d872

SHA256
b704317d4b699c3f6b6fa46a3ed810ee4468af71aef8760e1bd6a056593044e8

SHA512
3aa92013bf9d2b80aa78f51f4fdd6617d912dfc4305efd12ac9de86dd46334be0958fd9103b98d263e35ebd77d3f2c7d9a84641d4684957ea2af9a52fc61edcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
044613a2458a84d74f5db8a02e61fece

SHA1
7809f97a7798b6cf9c308c61825884b575ce7a82

SHA256
c5b78cee0d14c449b43f73a389cb2065b1bbee202b29ae68b2b4d95f1e794e0d

SHA512
18968f40e2b5b5431ab378c11bb8364f882682922ecfe6fba06aee649ac7ee04abbd36a07e9d31605ab12f67f0523d44bedd3e3366c435d534cc375d5b228fb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b42feab830d304606776825dfe5df8f

SHA1
1cdaa7ff0d5e013ed33e51f045aff1189ed01e3b

SHA256
3d58740a00c88fcb871ebfd77b905a9191f45a451c12f2eeaf0dee204b36f893

SHA512
95250de9248e7416bd8a21ad08e16221c38b103568020d09d89bc92e9c6f40006dedee19d8f3b6c05551fe85ded13f80e115a127f56e5561bfef9fd015441083

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1AD2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1B24.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit