0fe16554332ab93762ba71655c331f8b32a9e2c0af883fc8c9e05669e1eb1719

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 10:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f48ef7312fb33d9fc9a1cfa19d92901_JaffaCakes118.html
Size

6KB
MD5

3f48ef7312fb33d9fc9a1cfa19d92901
SHA1

ac6c1790dcc94ef8b77d9f5e9f00d12240602eb7
SHA256

0fe16554332ab93762ba71655c331f8b32a9e2c0af883fc8c9e05669e1eb1719
SHA512

b596dc69733e68dea6a61889e4ef4d1f7babb95ff110cc3e517edc92e4d8d68a7300a2e9f18bf88968b5451e712b10afacd34154dad929d2e41186739bf59b30
SSDEEP

192:ln8uqnGDSSW0nqTZeQa+L1js3PFvb+xGaUkf010LfKW:ln8uqnGDnW0qTZeQa+L1js3PFvb+oDd0

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434976532"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5DA37541-894C-11EF-A5D8-F2DF7204BD4F} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000a61678e96b7bdd851fc37d96913300af2cfba13dff7310026025c243a52fe407000000000e8000000002000020000000aa23d55dd545ff3f26b159973167ed26bd45e2a4595c7823adf269381f20708e900000009286f78a53525b52b1d4975454497e23de693d3045375437cc6886cb363f61aedb03fa924455a6d4ea33bfcb385be0277fb8326fa6da3e327260e85f894a1900dd9ed849be0d0dd2b0ec79c54202ff36e8093aef223555f43941f674557c7ce9df75afe658734982f66b9059a118cbbf1eb54f1d6b7d3f33697114b1ff660060a4addd5a3de131308cebde9d2dc182bd400000007853cc9b214074e92beb186704ab3e5002bc5d862e4869ea9d9804737cf87b7fe8162d7d59dfd840d9160cd0eec3489c1a990461181e1c9565e5c60a1586cf25	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f542000000000200000000001066000000010000200000009134c7de4895d679d9d36714391c7936ab1dc3ed25b7a5ee5b0205bacbb19e82000000000e8000000002000020000000adca0d60f673072fc1c11cced77b354f4b91c891a6349b47226bc6de33761b7b2000000053528c7ecdbcaad42ea1d3567c0842059413376eb6566331c193af28963214b5400000001e2e86b6c50c7b0afef598895a7bea5adf63ea63e1c2b2340c7cb941f53c228bea748aa04c3d54cb81e79ccb71742212805abb21eba7a1bfb64207971b024f74	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20c16d44591ddb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1964	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1964	iexplore.exe
1964	iexplore.exe
1540	IEXPLORE.EXE
1540	IEXPLORE.EXE
1540	IEXPLORE.EXE
1540	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1540	1964	iexplore.exe	29
PID 1964 wrote to memory of 1540	1964	iexplore.exe	29
PID 1964 wrote to memory of 1540	1964	iexplore.exe	29
PID 1964 wrote to memory of 1540	1964	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3f48ef7312fb33d9fc9a1cfa19d92901_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1964 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
b045b961023ff25ba77341b6ba47d7bd

SHA1
4a635823ae7255e6e4cb2d9bd8349bf1933f69d5

SHA256
04f7a67b2043ed63e850c7093614c627b10a91a197f28a31aac24c0f83deb47c

SHA512
f6459fc063231ff89d37fcb524c62ea652970b80d19b85348d5ffe3400017fb8d4ff05be3977ac05fa5c1e3bff71cd02ef3dd5bf679664d58dd47e787ef19799

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5fec258c1dfe885118d56c64203c9c0a

SHA1
7aba33fc8555dcacd4adf57713ee3a95053cde83

SHA256
3431694f9adda7b13d226ee7ecfee6d6026c153bbc58f5923881d737afe26511

SHA512
8997e806dc3ab3cbf53083acc1c8ef3dc8d4090926367d36bfdafdfefe155b6a7f0c7093f08cbb48feaa95abce508d944d557307cf07eb807587af4e8dc19258

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
294283aaa3e8c9af54e9bf8002e0039c

SHA1
d21d1e2df19f431bb8bd58857fbe18181c40dc71

SHA256
1614144bac1196a5d6bc8c5df988665332921861f48530731b9c2aef5103bd1b

SHA512
2c4e045e225f386f6129d54a3ac1c8a4e328c1d78abae2f662edd45fa2d15be425d5aa38e71d287b5efedbef715dfb69ef885c90c0311a7db79fb7b649bae36b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b6ff3da2bbaa9c31a1771f63c05817b

SHA1
84203a30e853df3e6b061f68f973ca4f77d508de

SHA256
8de1292c868c25d725fbcf37790e948add40fa380afc143d8e36a7248f586db8

SHA512
0b7053f4b952eb39efdce86681c51e63e4b023897363e9b907ac37aa05a4bd98e6db09e06add83927d4b1cd449e3fb154bff7d14d8333cf69c23cc68664460e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b2fde79ae787716e35ab05b4e38ff15

SHA1
57ba2e321bc5c44d67d4332923c896b72fd3a785

SHA256
37c95e66bdf13acb94d9ab37dd2fab597793b2ecd5c525bb4c8e7727486fb779

SHA512
965126a35bed40eb015ac242022aed87a7d0fd9dfdb8512d2b9a7c42541324d2706e84ef31c547990d2e6a7783f27711c9db54098d897525bb8567ac7d07462d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d12b5bd7a11d4d261f9a511743bec74

SHA1
54b11e06daef5c3e44505efb1a751e762ba209f1

SHA256
2a46587476357f3473b137a05217c0bcde7c3aa9c67d4814279da0ba373200a0

SHA512
989bbc7cc97e385504ef13f5e99ae44d236adb0fa670d7dd752b143896f6fd110a7b1944a147087dbf2b98d2cd5b34053d8dc2e5ea6f69d3a6f0f35f0f010d5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70f8b58e146337ada0e6167313daec3c

SHA1
70eddb013420b3d28db370cc9528b6b368de3be7

SHA256
b3b505d7acfee7099ee52bbbb71f343ae719c2a25960d965cdbb5ed854f4cf6d

SHA512
88efe1fbb84223239a7a14ad891e7651b0182708675d45e7102ea502865b1689966c8f1e03f25841773416705ee4f40bb120fa042f674b67040f6a6887e79762

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ebb41a83bceb7b8fef2c4aa3f938205

SHA1
795b43d25ee3bd1ff85919e6acd67f0300341a7e

SHA256
9cb13a6fd3fb0ff245eb522bd9b6f1cf1cf27bda8c2936706c1278d1359b4fee

SHA512
e418022ec08b75be3e97d762c093035d90e2fd8084383729b0cfaf403ebc6d3d0b3bbf69472eb629323cb3d32b1bdcf70887b3de8608b5ff1d92e032a329e766

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1008100b528dd3c1d5d7dd36914c62da

SHA1
b9aebd9d59f0bdb40092912eed19ba6d2796c879

SHA256
7af6d894d7794fda9fb23520189ef35e56645c4d093fe5817f61df4e87e9f3d0

SHA512
89aede7169ad3a709471ac57e27fef0aa20924a1e9a5baf1bd5d3f11a366d0c59241b16dc03fba13a73ca2fabbf1b1216d95a161c91c87306e64816a78980cd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
078d4986dfca8c3ce7af94efa808fde4

SHA1
4af82c749811e8a59b72c45da88b44b83f1332c3

SHA256
ca8b429b403ca4bb34d28218828bbc50ff17810452cc6bf5883e666ce39bade8

SHA512
8c38c7ffb5d296b945a1c82252f72593a52b6e261c4e965cce6750ff629430f6d3f34b61652e4656b8f0d909ef63d83013f32c85b2bf1696cd3d7af8dd7ce820

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67e95801368a8ae9344fea4b8e0cc09d

SHA1
ba8a380b7660daa579be70d6fc395cbf18317bf3

SHA256
3e1cbb19dfe0ea6ed532c5ef03db29051edd673586dd7edf8a7b88ccc8d347f3

SHA512
c4568a68071dd133d8003f73fed02ae0066a2ebaab6180ecfcf59a9c28089d339548d84107cb9c2c77223d6d97975764e1a3201855c65df442893f0485715eac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df91b5d2222c9afd2f1b9df5b0c2f3aa

SHA1
7a930e8875d68147356923e8b99b179d758e23d0

SHA256
e62a9516c9bd6ef12379b3e1e592f7596c29b3ed7d2210043c2d4529a5875953

SHA512
8edec0623a1a9747557f9e60f426cd60f22726e259ebe60cf467efd4faab0c6d66716ed804f90f904e676641468504794b3aa60ca9a007c377bebccb3f2789f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4aa6baf33588c85e3f34230488eea9b

SHA1
d421accddc966571947eae3e0df673c043f47803

SHA256
8f865f4130e10da5c1831dc44154ba003d7b7279dd859c8161e1b734c9f63519

SHA512
a74b2b185349ded6dc093decc8e82643ac003c8b0b8ca6d84949604e1dfe3e03d0c3095eb12cf64aa0bea7bd5aa6b90333bbcad900bf01dca831fc5f10aceb28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
00255db47e9d658b0f36f66beebcd643

SHA1
a230693885b6ab6cbadc27810bade4a7e9ec9132

SHA256
004c21c5118fe85a62a08a39299ccafcff85c448b12dc2af4ec0a9f546da9928

SHA512
8ac529ae90b8a9b9bbf791d4b78a911dfe570853458c14e449d3c514e66d0d4ab2e55c91f171d51682b525cd387713821bd1c07a374753f92dde3307bc7e729d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab91E4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar91F7.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit