63867b75ae9a8a3080832afd4efd03f27e504593fdb8c650b33d0d193ea7f2c3

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 17:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

433e65d1d88a862e277d8cf87a32fb70_JaffaCakes118.html
Size

26KB
MD5

433e65d1d88a862e277d8cf87a32fb70
SHA1

47b7bb602d82729a63d60baf4bbd4dafd3aa6f53
SHA256

63867b75ae9a8a3080832afd4efd03f27e504593fdb8c650b33d0d193ea7f2c3
SHA512

f38f81dacd7cf5194b469ea3d16b9f1018909876b55d3ef0c722a10b8a00fc93280a883279f9a69714655e95a42ec8628ed9f27968757bc4595cf45804fd233b
SSDEEP

768:Syo7t9q5GMXtg6kKEnC7dMJbDPxgrxW42k83tSrahgaSNt:Sy6ts5GMXtg6REnC7dMJbDPxgrxW42kT

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{14345981-8A4E-11EF-9E32-4A174794FC88} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd300000000020000000000106600000001000020000000a2765cb78f21b468b4cd6f9368497b386ecba4d376abce8d2d1aa3db5c1dee1d000000000e800000000200002000000049209dd93dfdda2bbb1fa2dcfc929bdc3d6a74f78dd25d256ceb237c2930a72320000000308fcaa4488f07798bfaec20ccecde3538191bf336c9ae4cbf0564f1245f0a9d4000000098004553d750bc9dbbfb59fb4a273233b14e4f421275cb1fa3969bc7d08e110bc3a7780c87dc276bbe900b434e276c1876f7e3d55063f261282f2e33d00bc381	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435087211"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd3000000000200000000001066000000010000200000000bfc004872ace046a49b5e5d30865d779e48d0d36e142d489083c0f9e5d16955000000000e8000000002000020000000af8659147f7acaef6de8837295d89ab13cc147b61ac0b8f2216e0b41daaf57e090000000bbb3538aa624b59c4d541c18644f2b63f88f33611483531b5b9dc41f27ef6476ba5b76f86485f148ea58dcd4b99780806edc8bb1a40c15d6d7474e3916b9237fe591de2f4e7cab855def31c031bb285bf7d3cdd10850f3e8c7aeffc5afd3a0123845ffa1706705f236038f63c8ee1dbec51fe4e4eed3c883091a190c6ae7adaa1cbb0025d9b4ee8496652b0f5b0799e4400000000cdf565b4bab9ad6d8ff193f304213d8c702d59524a4b1df2969d8eb0d73eca89004c777e214558b5b3aec302823aa7b3e14c1a03b94e443fe548e72839bf9a5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0a886f35a1edb01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1404	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1404	iexplore.exe
1404	iexplore.exe
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 2340	1404	iexplore.exe	31
PID 1404 wrote to memory of 2340	1404	iexplore.exe	31
PID 1404 wrote to memory of 2340	1404	iexplore.exe	31
PID 1404 wrote to memory of 2340	1404	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\433e65d1d88a862e277d8cf87a32fb70_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1404 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
71cf2f18ec93db27fc4cf044bcc46fd9

SHA1
fe19a3d82288feec7946efce8c1c9e08959ab924

SHA256
5559f42ab49350919038e82546fba189f1b379d539de228bc2275923694571bd

SHA512
510c7fbdd4ec89ad7676ef6f26e7b520c8ae4529c390f6e41a95c7f207f1c80833f83fbe8c7abf444427b0e00dd7b8066c8a0c51b7e23e6bd3e1a29a02c227dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16d11b9526d62b530a146cbb0cade178

SHA1
b95944907f20e160afc1d0ebe0e581da79199098

SHA256
3754b06a5e55d0aafdc4db5ac72b3229189fa94041d2e776cde016d48888749a

SHA512
b821967fc0b5b125027a22041c2c8d421755c5dbc4e52da7b0627f05cdb5a5b0e386836787560dba4915a308bd77b3b2dedadda38358da35f3abc26e6c1e8535

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ac0e4113625b31aed6b7f37b524ef36

SHA1
03b0b530525b949f13a81f06ff7ea9d4001439d1

SHA256
492b0e404ba6bc69fc9c713cd738283eed9a95ef6e953404994cdc9fe63c5e8e

SHA512
a239fa321a2ebc88f9e48913726ae639a3cbc1852766b1594e16cdde780150f3a2e20d00a2f11f75f4b32ecd139c22651efbfc877cc97c389b0fa64dfd5f5618

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a06fdf484a0ec07eb92e80d10352c2c

SHA1
5bcb3d0b9d6009ee9b8f8fe2e2c0cabe8a79fa2d

SHA256
4f6ac116f4fb8eae4c3c596104abbd65c85f9e4ea6390c16d8e56efef400e14b

SHA512
84fb58ceb25a41120407745c1fb00304e1f35a4e759f38a0d308a4e34b52ec7b88a0aa28328a8ef3121c2179a9f8ec101da7864bacd57fd64c38b1cbcacd8cb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d9cb6baabf284f331c690e93e21271a

SHA1
8b82548afb8ea5d7b41eb99e57933dacbe3192f9

SHA256
2244e8877efbdd0b5f720fe583b456a5db7952f03f46b13cfced572643c37c47

SHA512
72685f531320756ca648ed6add670b5d1289e4124a808ac34207720bf0618776f10f54a5f4f7c211ca6a3ed836e897252a60cb2a96b358e27601acfa934940c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79f47b92908e23d55a3d01bc350a3d77

SHA1
78ad33b4453734e1ae92963804a8e9fbb57d1ce6

SHA256
d48fe8f65aef71f80e3667b0099ff51d83b4cc159f25b977b1a3edbd086d8a2a

SHA512
e69b78b2c2336b060eb46f6b423b60f653e813cd69688b3f1bd5ce864f8867c4c99b45ab1c7869497b5fac9295ab212d6226daf72ea62621eb95f24005d24f63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37e265a23528355236eedfe4845d2170

SHA1
bed03e9d0aceaa2a58608da95dec8b191e657e43

SHA256
da078e015c091db75665855a137f644b3c70f79b1a5b38398f7bc7ae59dbff32

SHA512
37ac5fa8f34ed6e03b1a5bb62ad1bbb72834555c36027abb635039f1608cb77d1d89893db2d1096a1fccd3a8758ed0115d7b5b48fb7c1ed7757f7160edc56dc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c587746d31ece122c2ec517583613b7

SHA1
29052aba92641e61ec422aa145d8ae6d9b5a9f44

SHA256
d5ea45944ca6e8138a07275c4bb66f91cb1f121d4c606defbbaf6d5f4ebc7404

SHA512
e368352f180862f511093d496a93ea63e3530adcf3cb60abd8a80d4f79419ebf72a41caf1e2ca8825f7bfaceeeb2320f2c3a3f55586b54d46c681556dbc50286

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
c9ad55508578ee3c8e6d8ea689eb19db

SHA1
6e818b09bbe78399313547ef60a7debba46d3132

SHA256
ccdb44a63e07e8555cf153e0265809b69e2b98f164d582b2a3276aca211742c0

SHA512
1eae3751f367e9337025fa55b3055d9adb7c2fe23ff91dece161bb754f767a9a1d458faeddc6a5b555eb4f16a3794ac32088fd7195c485cd2cf691d928fbe200

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3787.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3788.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit