683df567606891e34f83a5f72e73ff341a9adf48dd54bfc3d4dcc8d70df4a1a4

Analysis

max time kernel
141s
max time network
146s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12/10/2024, 23:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3cb3b6e5a47cff52b128dfd511c24141_JaffaCakes118.html
Size

58KB
MD5

3cb3b6e5a47cff52b128dfd511c24141
SHA1

205b32ec57eedc97030e0ba27a24b67094c89cff
SHA256

683df567606891e34f83a5f72e73ff341a9adf48dd54bfc3d4dcc8d70df4a1a4
SHA512

f1ca447261ff68c581603cd5b9543af7efe26451d5f02f98c6342e232d3cc27be1355c9131ad8c6341c58bd556e4810694c383039cc6ccfe1aa52b38db946240
SSDEEP

1536:gQZBCCOdh0IxC9GwBfSf4fTftf4fNf+fEfTfrfbf0fMf1fqfQfLf4fvfdf2fHfRj:gk2z0Ixg6grFgFWsLjzsUtiYTQ3F+f5j

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 808c3c3d021ddb01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{67E15B51-88F5-11EF-B221-F245C6AC432F} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d907000000000200000000001066000000010000200000000ee12c8e193fa62445caa7b3b4da8114d274b72a25fbb6e4b3ebd4dcc8c5974f000000000e8000000002000020000000e4030d86066477430ca618e36ec7444d55b633fd9f45a4426484b145eaa6b0202000000072e9989d2006bfd600bdcdcf50b7de297308904e920acb6fbd901e69b1e0669b40000000d273a1266234c2447a9a7b5c26a7596876d2d4167d2ac864a9d15906393a4d34d7bbe12f57e4a3f83866485efe69d9d12ced5777c434c627b6c42e9c6e223bfa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434939181"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d9070000000002000000000010660000000100002000000068e7685382f6eed2606e66b348e6916cd7bfd74400e17f39b878ce9b34f9d3fd000000000e8000000002000020000000fe6e793cc821d9e01d5946d8071c07f65792c5119cc60e6cdd9da83b48e35e0190000000823a43f23235d9550b41bbf0f317ec60807be81ee8b19b5a40c6b4c07fe2843365fe945d2097c2269fb1bd625db116435a391cb3b5e0290afb40ecae5f28d69810376f59fc2b3229ae255b42bf8aa205810fc4e348a57ca340e494d98772890b731d28c601ac8ba4e7fd90ff39e832d59ebfcd3f7d57d1a8fc09472f03bf7f5aed190c414e46ae0736599008913e7eab400000004680232de37cf7166477ef055a5d330745576b9f6f276c1d8385cabd8b1821e19eed06f88a9e8ad813f330f550fa811a759da9cd078330c56714014aeb1a5f03	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2104	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2104	iexplore.exe
2104	iexplore.exe
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2724	2104	iexplore.exe	30
PID 2104 wrote to memory of 2724	2104	iexplore.exe	30
PID 2104 wrote to memory of 2724	2104	iexplore.exe	30
PID 2104 wrote to memory of 2724	2104	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3cb3b6e5a47cff52b128dfd511c24141_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
a8fc47793e0342d05e8d4d8884f1c656

SHA1
adddb5ae872a0af28c584db1b4bb4a0d531c0256

SHA256
d98dd7af4ac42f32273440188db692549602ade1e2dc3c295795da5379c2078e

SHA512
f08251a48c4a2cd609235913d88db5f75755e73f6b99a0e7c69dc8819e47ebf162275b95b4f18f2b08bbdf92c5b9f0018a1ec5001e24ef7671e1ed32d5c01d17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e17e89f3f7cd834fb381d6cfda1c7ca2

SHA1
913c274747d4386503b4a96a8b3ec8b082dca8a8

SHA256
cba3770519d5327cc2fcaf8f53c0c7c6889d72bc598856a5f825a1755e29d25b

SHA512
f161a453efb4c949c2a3b2d819352aca0618dda7c887d9d128dce35f23faf1615f9295571544394b26bcde307a80d0b6c0e4f9ccc2ea4e3c1d253c555def405e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3a8154f26d339be4eae02665559c279

SHA1
413b7b8982ab4c8d6d838a807275931071b75bd1

SHA256
ae15bf2f62930440736dbbb9e98d6625d4556420997cff7be05c46b36d18e0d0

SHA512
66f135e27badfd39e013293f7d3c33c64f8f5e078dc46d5567176b564c3b1fe70ca89b3941f5e87239c49c97af3f67df40ae4329de62f6937a5be78a6f2a4bda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f39c6a28e5443d6dd4638076de207f58

SHA1
4e882950fabd22fff0c2806b686ae7baee5f1e77

SHA256
07ac039e2444b0f53c87489f02910a0ea2da6d8f4ac5c6e2a8a2f6292e3a8291

SHA512
20d63b6fff883b5eae1ddb8519073748877d9cba905ac5b9157009e2d4d08614415631901d509cb86949a961a122ca9c8a6a31213e9e074c95fc01745cb4e2ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c157a130f534c7a7d869cb7766f9021

SHA1
3368a45d31d36ef3d2ceaba4429ddd3a7b32377b

SHA256
151c2c4e0ae0b5eb3c8c82aeb2b7ddf0775e93e1833686dc016e35cbcb138791

SHA512
cdca89a0aec8f34f5e94f66be7864e7d219b5ab519d4c2f6bb2537279bd9018d816444dde5c88b7d915fe35b23ba4fecdcc1423a7e6c4800a1801cb71d2710fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aad59e38787a42ebb7a5b48873080755

SHA1
cfcbb99ecaa223081143cd850fc08274ddcf0007

SHA256
f210bca73828606e8c736d85e1437f95f9d31da722fb05a8d673de938913fc62

SHA512
07e6a1bc5c627399011d8088ab3cbb9246eb36fd4a215da2c0b3fec2abca0cebcf8eb24b079bfdd7a10304fcd20a0e4c05f8d902478c30006ab78855098c26ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a156eacc5abb103532237b864c0bdb0e

SHA1
46132e5c73a85bd28d871dcb76cb8a3dacca9ac2

SHA256
fedb374017225d756eafa200e21a41d140bd9eab8b15f94102f2ce1ae108f4a9

SHA512
4060f01585f870c3213602680fd112384aceef705387dbb4ad50ff6cbdbbc98a47c2ec9e80a33ae3fc9ffca277956eb981630c7ffc9379e12b1f4955384d52df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69bea52ceb0fe17ea501b1b568b15f27

SHA1
ca4dbe79c5fa6c4c3eda59b498caadcb7a49b0b0

SHA256
f8d4f6229358cadd1243fedc6712e5742b61b99a1c33a7538ef082662a766f92

SHA512
a728ea6602c791965839654d2c430e2356c51fa87af54a5255013e9084507ba4095cb43e4e123d1d16d2dd46fde9a2ff45a5dedc8cf99f1341889d3a64b19eaa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21fe08aa139c45d4d3074e152999b711

SHA1
e3076e46b8d3dcf648b6ddff160d9be1c069fdf4

SHA256
c27dc5e238af4ec8553435dd7003f7a4cb6289e4c69393cae98193afd8b09e47

SHA512
7c7978b10d877550bdeb1dbbf4463f3cadb7cf9555b3d64279cafbb789c4e0221f78382ca4443c926ba2a8de2a3afde676079658ec664eb303a25aab6d2397ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4b33671f57952e377181281c3d62349

SHA1
95e25debf1e8fbd5b5420753d3857bd2a58206eb

SHA256
4a17a4cb864eee16ed4dcc73cea78cc6865e7544698c104b79d31da50a6a7cc4

SHA512
e54d5a917b0a1a65623dd3d74524636230b50747b1eb5a7a659435e06d00c1c9b22b6292bb9a2413ae3260bfe0d7a4d8902ea683df26c4b593caed01492f42f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f12e077fe76955f0754067c65b0733af

SHA1
a5517f554fd924ffe4df3e9d524f0aa6b9c53754

SHA256
6daa433f1c5f2644f3e5fb1eb2db46c2b2ade80210a590d71569f870c2be0d0e

SHA512
5f9a7ee0b54669cd0757d14c80768647c331a313fbee1b4b241d790cf9c93ec530f1335ffa7c669ba76843e2e9be712aa86abb7e7fd96c086eaaa52c74d36016

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
2521eeb8ed3c90dabadc6f1acec573b6

SHA1
950c62c97f7ba155f27e21b8329a5d128aaf2eab

SHA256
3b62818d3cd22642573700f6cd7ad74c4dc86381a7625e432d53e4d3d585fd9f

SHA512
58a0051fdc903ec21a413601e1ecccf3714aabbc980be77d2bda037f7215be65667fd2b33389d0f469a17900e50d925d1bd2c677a7c6fa29bc3348ea52aa7a03

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab65C7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar65C9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit