616b4b9041085fceb14020d3fbb4f1ad785a61ceded2277c1edae1e7b17f051e

Analysis

max time kernel
120s
max time network
139s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-10-2024 20:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

41f57e785849fa06d4e9078308e9addd_JaffaCakes118.html
Size

11KB
MD5

41f57e785849fa06d4e9078308e9addd
SHA1

97cdcb033964d278df1ba2c098a502aca7c0286a
SHA256

616b4b9041085fceb14020d3fbb4f1ad785a61ceded2277c1edae1e7b17f051e
SHA512

ce512db5a884f497db8c89cb6ea9427f282123bbbfbf72e54653676bf80e88835e26b3c5bcdf67acdef1d11522e6b8c08b20b9eb5b4d863313d0287c2b58a39d
SSDEEP

192:2VklIsr03F28k/w1wvqyoBkPndoOQli018LOXuBuLbdU8d:sklIcuFG/gcoBkPndoOQli08LOXguLZ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F8387EB1-89A2-11EF-8632-EAF933E40231} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea220000000002000000000010660000000100002000000078625495512cfde9ee3f83045d675604ac60af185f3dfb660c02794b920f6cf9000000000e80000000020000200000003f5dfb5167eaca287001794a802728737f775edec26bb66168747ed1e8d663aa20000000420b9f5f4a15c86e58126f73cbf8bf138d1c332632b57bb486587055d8a04ec240000000708c8f8eb8e7814c4e81b34780561be8eef3526776c32a261777631552fe9c2adc89ba377c57c88e63826e1a057309d5319c988f53d21be02049931bf98f59cb	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000a3708381939ee861e69f386cf9845d2437448cc13e0504e49eeb1f235b72872d000000000e80000000020000200000009dba506783a10aeea0778c0ba06f5076addfe7d21633ea8e922434f554772d8e90000000e90f4d9c9122082620665effc2173f5a68647898d4f52f9a05ed64a20f54ae58d5e18c531febcf5579db51b1ea802d371396f94ff177e712658898a7fb4fc8b250d2d986039579e8483edf5c8914eb2f3cec612b475cd48a9ab0a9c84c363770a4e1ca31732b980178b64dfe860cc86d0dbe4f6f1344357810761cbc133b6ebcf8094fbdea19b340f9c956cf48425f7d4000000061b08c60dee65071c97d93d1afffaa6d730e379eca85e2fe38b9b73f3db8e122ed30e7c59b7fbe01e560e792c2887066b344532a6594c4ee9925d99cf1882342	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 002e0df7af1ddb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435013721"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2724	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2724	iexplore.exe
2724	iexplore.exe
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2724 wrote to memory of 2824	2724	iexplore.exe	30
PID 2724 wrote to memory of 2824	2724	iexplore.exe	30
PID 2724 wrote to memory of 2824	2724	iexplore.exe	30
PID 2724 wrote to memory of 2824	2724	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\41f57e785849fa06d4e9078308e9addd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2724
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2724 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39b25bda2584fedc026220a8be83c2b1

SHA1
44cdd2aaa39e90f03fddb297bf3ad55a680aff4b

SHA256
ad9555b4da7097b1eed97b5a5865e002e711d99dbec077e558f175531d16e044

SHA512
674ae9081ced7fdc43c7b573330657f1378d95b094c76296f8f83e256c0f560fe01ddec086c5771e5a4d10d7005341abf13113f34ae9b1fb101d09fafb5b3ec5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb03f756160ca0b339ca515f02347480

SHA1
45dda57848414de58cd4900ab63762ff9ef409c7

SHA256
b031cf0a8550549121496bb2739310a54a769f3f4a6097805b5e6cc807c88e26

SHA512
e0e4c90f38b63d12d523e5ebeab901a3299e6b87ebe3f5091a8058470016b290e822b2d475f5c23cd450f92321f49cd91b89c2476a77936664ba970dcecfc08c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9699c59103e983eedb4b4d691eb8cb6

SHA1
cfb54b604f72e4bc69ade957746f072fa89357dd

SHA256
fa5adcac9b540944f16a7db46138309fc9576ac2c108c9ccca7b6ed0d9a1c2f0

SHA512
268bc6f37197a3ee8470ddef1abca81bc28d508c1ae9e67e717ce66e18c57eeb1ae0fdf601b0fbba753bc58df15b25fac3826dfd420d72e5425a4e21cae7db40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
498d744d25389e8fc2aad3623ae5ec55

SHA1
284961188ca2857c24cd33fa0a3012c5b2eb7d15

SHA256
62d1358cf7eb70c115725acd5736ba154b4fc385727b075033bc001cea0c03a2

SHA512
87a7d85bf9fe8818ef851e1136d0580f13f69633e07d20048e6fdff2df288a2d349bb63b1bae7cf4ee409ff14b09db6391d43f577b10ead04d9f5164f1a3ca08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
742fe6b3d5d4b04e14eb805b4b7990d4

SHA1
e457eb5f1504ea1dbcf5f556b661f32ba37f4843

SHA256
943b58e2e019b8ca5b6ceed7dc6749e8839c6578d4a9eeb41907f2152298ae3c

SHA512
d9ab4f459f6c15e40aa01f257407ae0744fbdc9cfdd6ab8eab1e57075c5c671de2f08d57787fc1a641df55aded6850255813be4af48552e6d532d81fbe2a50d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e47a2646664940bc62a1617a498959a8

SHA1
4f9aa3688c6cd0f1a34154041ebbd02a4b90db8a

SHA256
493f6f159eff929b3aa9cdd9f80b5bd727d0671e7215912c616367710c1d25cd

SHA512
a09a993f4de8191c41c4338b26a9e73f615db546f93225dec269723b59c0e246b87902613693462a3e1135b93a671436d78bc4c3d93253761ce4b5fc88841346

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ccf2cb156aa74224c1e8768dc5c42fc0

SHA1
c5d6db9dc097fb5575fb7d7df3a0ca6ed5414272

SHA256
04d0d9150d62bdf418dbd094c75bc11cb31ba7a3dde53248f220979344f02a2a

SHA512
7770271c3cbc73a6d97883490b1aa446224b52c4b709d46739e5c92f66e96d422e65c844f2b203b3fcf2e31213746c33916b3ca02d842d288709a2a2850e1d2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
849559aa4eba65094518469c69b7b050

SHA1
f347c1c6ecf6918880b87d04d01c378517a91aa0

SHA256
7a426c9b3254c962df34efc8ff3b72776aa3dfd6320a83786bb01e4d0f3913af

SHA512
0a351e95a040ffccaa9c654b700cb23cbebf550b44c7eedbe760b9d0041e4403b52aa3c03d1a0af0dcb345b1658e0afff9e736752976a4aa43e7f36fa3425970

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f76c654dce883e7c4c06a3212b992d2

SHA1
f11cb12c063bf779285a809260f5ce8a06ce5deb

SHA256
d6c122021ca93dd01f837b2bbcedd0ba04067c354721cadb3e5c0cb5a9155ad3

SHA512
a3d94a535bfbe39f5f65bbf39ab3275f599f06b7e63e8850d185b0de84a7b000a356ff6f6e081fb0881fec45795bf14195c3232a865d24614e6e14239254f651

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d98c0b4b4c8850a672b4c3e0ae741c33

SHA1
8a12a913be0bfc3c0561efe5aaed2862d037a4eb

SHA256
7ed3fc2d3a3ce6ff26a57b719e07414cd15d2f89e8e9f9489b873108117daefb

SHA512
32b304d586ee22ee4e687fa101aa527f70530010062d31c910289aa85e117d71c2a52cfc82a4a31785c15b81f8747a2820a355b0af505d376d432f5c75d8f2c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08d832d0b11440e15bce4e234f184ba1

SHA1
717b5c102d22f83b22635f025c10da8c0c42e342

SHA256
3da735aa7bf6e73561d6743e53a95203cf0368f99de392aa284f4fba15497350

SHA512
01de2482896bd0aa07fa764d921795fb35c75d62cba2f1eb58dc9eb50ad12616af22f7a5a425e268602576ed8765de3745eb8c663d6cb4d2773ce88b112639e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9316689e31891b188a4f19cd382fd34

SHA1
e683a063e98e6558fc5fa257a5abaad936e623da

SHA256
3b130fd018267e4af562725db4a13e4f85d02ca39515fba4f1120f348a719371

SHA512
1d87c1c5a50f7f4ff0ad6759401b794fe82f75ea6d65716e04c17063645b4a04048773863f5bc0c3e56cd24203e8128fb567f6d1f8faa4402d2925731fe95cba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b95192221adfbb635e1c0985bc038c41

SHA1
2740dafa11c66e3df4f5667dd29b0de92488d37c

SHA256
3b394b3f14a37b9e56f2c9cad30791b1bef1925ed646fe7104905795d8e7ba3e

SHA512
b32f155d533f81260bf5bea2c0853118b6875eb752601f86a3ffc55cf930685ec9c7de0eaf4d095b0bcaaab3be6cc0f635dc0ef86ed4be87690622297fd54513

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f1f51a2096224dd9f25c7f3c27e06b4

SHA1
4e27a99a82331839832c28769acf09236ecd08d7

SHA256
ce77fb2d14d9be547cc02799e0e1adc446c5424195c9c2c924c1cc5ea45700da

SHA512
7ea433754a2877d1e448f304c48fc9752f10e9653ecdca5b5bd3c85f82a3c89ee7dea849c8441ed9bf41338de936b94a5425e9f8f1352939acebefa619e44166

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab625C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar631C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit