735f982b19de9300499932576a95e5b48e16057fc83d1ac89919dc2c8ef4b8b2

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 06:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e51bedf21f3417fb21bc9ab3fa78ae2_JaffaCakes118.html
Size

10KB
MD5

3e51bedf21f3417fb21bc9ab3fa78ae2
SHA1

3010baecaed23c2ca07039dea61bc3c34ca55f3a
SHA256

735f982b19de9300499932576a95e5b48e16057fc83d1ac89919dc2c8ef4b8b2
SHA512

7b039a0e4777c5e997bb41e04056a4f639b803101c15fbed4a8444c1bf2ae279c672a00d26ff446a2bddbb7105198406abe203e4f8bbaa6f12a48aa964223cfc
SSDEEP

96:uzVs+ux71VsLLY1k9o84d12ef7CSTUeGT/kjyp+AYjK8wlVHcEZ7ru7f:csz7jsAYS//0PPHb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e78a69453f00554b9c7935775bae7b96000000000200000000001066000000010000200000008db1c439e8932d33e23b903933baa074a160a5c1462145a699e4c74b2d27d6b5000000000e800000000200002000000069ce593673710ae3e434dfe8ca77497224dc07e57e2a3fb795330b17f3baf27420000000c1ef9d94cd336ca3b8d57a3c533b653a0689da0de1b12dc015b515d2cffabe474000000069975964c3f3b4a290dbccd5d23f2e01d08201cd7201079cce0cb68adfbf79001bbde6363239efc22b1a2ebe107aecbafd11dbab1b87f806dc33ed83f30b9380	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AE09C951-892C-11EF-AB56-7227CCB080AF} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434962914"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50ac9684391ddb01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e78a69453f00554b9c7935775bae7b9600000000020000000000106600000001000020000000dd95a95be465be21bc41a41645812ea90858e530220a090fc9980e99e6f0e3e4000000000e80000000020000200000001149f9bfe1834d5f0dfd0b8a73f9576c05fd04af57d97c616b3cdb47833338a4900000003339f0db3371ab966082b67d2cbe2c3aff8ac3309132aabf76c61d0b95e09c7e8ee25c982d886e014c3dbee83a30e94ef081bba8b3d5c00a44df9ee33be845ab58d442244571288ee0caf0637fa6ff71fc16815eb577758a3f363697d1f98b25446c41ca9f331732d3913307e0914f28fa374185fd294395bb06bbc7a38765790d95cf3aed22ab3382f3ba2bc820bdbb4000000066c35c55b8049cc9d6625086001cad6ec341025cea68cc6ac56d399ddfad97d3c361b82a67b923ae5d6d0924b2c0f12a2b85b52756ccfbd7b1ca2439f8824181	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
752	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
752	iexplore.exe
752	iexplore.exe
1512	IEXPLORE.EXE
1512	IEXPLORE.EXE
1512	IEXPLORE.EXE
1512	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 752 wrote to memory of 1512	752	iexplore.exe	31
PID 752 wrote to memory of 1512	752	iexplore.exe	31
PID 752 wrote to memory of 1512	752	iexplore.exe	31
PID 752 wrote to memory of 1512	752	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3e51bedf21f3417fb21bc9ab3fa78ae2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:752
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:752 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e217e9799452edcf6d42dad9721d82f3

SHA1
03f90f75a19929e869c309d790232ce331fde84c

SHA256
64259617c40974bd34e94198826887d94b42861575879c1704d55200bdc57e5b

SHA512
8c935a4a19b6251c83cc938116d4a2e2947ed6f3712839a21fad4d49e937a8c766a75883c7b3f7e4ee5c73400643d0dbe21949e080cf16df63f4795ec39e592e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
489b99122b57f25d48cb7ba9a55a37a3

SHA1
df6ef834027a7d7642718e04c04ae6a0f697a9b7

SHA256
6d5b28f12c6ec8858dc8680b8824f1bff8dafd215ab7f3cbd48919e88f4c942c

SHA512
16e575fdf629f6d1a5687bab92530bc5fa4614b6919e467f320ff24b5a6c47ef963328fa4f287f7edfe97621e0be606d2399dd265abb6766ae3120b3dd80e116

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78f175d01c3e54d7d2c6871141ce1a17

SHA1
677000bb44e72e6279f6a0c206652b727572c74e

SHA256
ca320d34dff2eee8c03d8c687c712fbc96e88dfd2b5d4ec3a7a12f2deaecde34

SHA512
2cb727590f767fc40f76b511da85a2e1969bc4e125d0e875962c30d61d1132a88e8b4390dd0b4f5805ca18acae368f636091121c4334937a7b2caf0536c66419

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c021d436e367fa01fd526c4eb6f92c49

SHA1
ccf7684f99a428174557146090c3d96e1bcd23a6

SHA256
b1ed9d07342393ef64c008c201b5143dab64d90e08c1588569c2c9acf83a4399

SHA512
583238934996c247bdac99c31ac392651c95b93f9028a5b978a1678234c96f2a17a3c55bcf1ea7e86f77003069c3003a137c6b0a982a46d239f1fbebad6a7811

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38c7a62a408a2067f8d03450e7f84d3b

SHA1
65bfe5557ea29d3531e0c7e6839d1e583b6e9a41

SHA256
aed753f5245200b3b1bdbbfba18e5fd42fcfc2565a2637b1d0f6c746f1922bc8

SHA512
096d1375d437a0a6ccf76bdaaf386a30dddbf3bb5425860c58c5e442899d8fbe9e8cdd0a65fa9de9ffa260e41cb63bd17acce4f7ffd849da1075d0c883f10958

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ebb0fd098dec13f417ccf9875d88a931

SHA1
8eaba0b83ea4999e3ddf9e5db49eca698750578c

SHA256
32a89f3a81c9b6a3b5666bc629dcdb91926bcf82bb2aa67df2cd76f9bcafaf21

SHA512
2f06ba39cbf8db4ae709a0c189609f92a6bde66bce7d7aeff276f13bd78468e8355e08751c0f99cd8c5a1325966cc1086587a56616fac4ef16b4e2cfb3c72be4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a1e8533b6d7083c4f6afe7a3df4e0de

SHA1
6d6859c1107e738835248bd51032212b84422370

SHA256
ae80a8db2bab9f900c4557b0bb106459c2b2eb101a5b5e58fe6daeb0a9d79d05

SHA512
dfb1dab82786bb0d588e9021c307943001531f13eb2c8467588cc387dfe40913fee7e4e899fe9d0897373c228188f9c6d18d1345e52004121a32c725e122b1fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65b01fc77f79742badd91070439047f7

SHA1
0cc15363c3213b4d40b247de830e4ae5e4f47824

SHA256
feb6ec05e1aea0a616eac28fbacb98ae864c5bc9510aa815eb57cd760a83a8cb

SHA512
dd3a808a4da6e430a6e4329c2fc2af12917f06f4b0f324f7c07aa57997e3828967b94a0fff7055014b50eaebf635f6451ffe00bfd6b99c33493738b4cb79cd98

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7dd9af315252a9cf68ee4fef555585f

SHA1
3d77d2b787869208a1e61b93b30c13837c6c9567

SHA256
90ab76392c13321a6023694f22aa52d416ee6fe87eea9267039487aa230d6296

SHA512
750bb53623d0cc542501b442d487a5edcf736f1431fdf485dc0ce034b6c996cf57e6bd0ad58c550d57b352ea579cd0f49ade51e06bbac662ab3549d0a38779c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30d6471850ae2dc7b8ae73aa3f5f6901

SHA1
19e5e801bf4893e97242277492c0c37c5144ab96

SHA256
6309cbb82061c92ea112946d8f6c38356a4955a0afa8dff41989d4baf0210b84

SHA512
f8f8d6f00bd7a8639bda4270d04015ebebc4ae62c76fdeb90da1ae7081d2c0f2f20541aaf315e4047e2c32e7551c00e84818dabbdb4a56daae3d91a07b08b9c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2d4232b8d9831e64af8031cac2c7437

SHA1
75c00653b588ceaef0f310a78d06f4e978f95af4

SHA256
8bc10eaf47bd1902f793f3dcaf7f2ea465ff9e32beacf118ac97a94a12c9fc71

SHA512
ce079914e76e96828bd108e1a57597a2070e15590bf1db4f88b1aef449673fe27ba7b96d8384671574b981fa955328e8d824b91a3729976bf93af1188c635eba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85a97808097a4a2f170eb496bca47731

SHA1
cfa9bdb672660d4dd4485b9baeaec248cef9ac38

SHA256
5325cb2028ef0f742c2270254bbc339d4e637acbf44df36532c4e7e3fcf8a36d

SHA512
ffab6732a5a4484917a43cc18a4c6548f7703ee4f3eb73446d39cbfd8ce5c37aaa90920c79661a4d0080c271e04afc7a1572357c6a2741bf6b4fa4c6eb1a29c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3c8bf057602daada8375cb9d196ff15

SHA1
645284ebb83f3930e814424f80db0004327711bc

SHA256
6d5950bdfd26c5d4d0d4524b32e42448041acf3533bb3538ac6c1a525b99660a

SHA512
ae3b2572af16f867592e1112a6817cc71c19804d0b7641ab350be3735bda3ef80b00fab819861f21d3dcd3529b0b2df58babdcbdaa7d562800abdf4d961857d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e011f5cc54a73aeaae29043e7fdfd125

SHA1
17167fcca402503aec11f0e5ae9db89ea6c7ef2f

SHA256
b7d36c5f81a8072d5af947c9b83cfed5c5a5d991931fb35c570586a3689d6f27

SHA512
b06de8a5f05f8a800e9da184118b0b9d08a7fd9eb1460a2bb3f94336c9288c1de5a0f7436c7621e5763e5715ed1ca2141e5cd44e9464d5e7b1e72f4c62fed1b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6315f278ebed05ee8bde0f1b53b268c4

SHA1
40d164aa87fad6ff10c29b60912e827247918242

SHA256
705267cc15efc4be66ea4eb239997dbe83b993487e2279f02eb9379dc932f2af

SHA512
ebd2224e87302168e817fb18b71a455663b3005064ed4d01e32aeb97952a5520bf548fb5ec2cbc7f4118ae69cd41c5290e4778785eab829cfe509447bde0904c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF6A1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF731.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit