7f7699470d4beb8cdad1352f467aa025185a90aff451abae61dbd703a0da6cd2

Analysis

max time kernel
143s
max time network
144s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
24/07/2024, 00:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6992b237e711095cea6e6d0584aba299_JaffaCakes118.html
Size

1KB
MD5

6992b237e711095cea6e6d0584aba299
SHA1

c3ce514dce66f2e9c6aba4966082cfcad23fcee2
SHA256

7f7699470d4beb8cdad1352f467aa025185a90aff451abae61dbd703a0da6cd2
SHA512

240ea18c05ee2ca699d65f41526139a2b7d4e441556eb812b859361c2c0977da9564c8574aa59531e965685406a1da74b25746021b15d53fd894c5c3ef577420

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0d9fac960ddda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000820b9f6bcc2ae260b93b3fbadbefff4295f424cea23de667160fc831b57dde51000000000e80000000020000200000008f64e6465862cbd3a2ec914d3a54181d7334a5fc9c1ba7cded7c70c52b8aef059000000036340b5b236526fe9496c0205e115de86f1c740ca6e890a4cc0a4347752c88a6577285cf6010437840f4a0ca5640853396875730f44d6cea60aab97275f51fd496c52a15a225abeb37a777eb67c122459baaac8ef9016e5e916e5a9eed0600e7af30e019281eeafd1b46861566261291097c7f5719b30b5873e891a132f838277a740f00a60b9e01f7d54e37caf34aa740000000a81c6d48e6dc30c0b62d9c5ba3d7e6a28ed0a90a524216bf5a77460c7362415628549c30a02da26dde3a7fa65734a578c329e0dc5c64b7752b4e5b749304f5bb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F0D74E11-4953-11EF-AC6D-CE9644F3BBBD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000b578b050796d3e28e9733f58ad5feba497bdaca3cb82e396c7261cbb1c3f8bc7000000000e80000000020000200000004063fe2e044c952454d4a9fe3419892d0f4af523622270e15d1ce7676d259a0f200000005f3df5da94d034dbe7ae884b0ccb7dd58b2273f9b4e69a9aa5768fddfe84ca79400000009a32c24f2ff9c9b0a6f2b1c68d0d1d50b862a8dcb75f2a054e8031b95d8be52cd80359cda7b9719bcce0841e23d9a9bc784238c444cf3f3284af3f5780848902	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427942905"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2500	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2500	iexplore.exe
2500	iexplore.exe
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 2392	2500	iexplore.exe	30
PID 2500 wrote to memory of 2392	2500	iexplore.exe	30
PID 2500 wrote to memory of 2392	2500	iexplore.exe	30
PID 2500 wrote to memory of 2392	2500	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\6992b237e711095cea6e6d0584aba299_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2500 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12bbdf34812fa0f840e5cc1fa854576d

SHA1
10bff996e52867e0f4695df4638dd3263a8eeeb8

SHA256
c0eb64256d018f0251992bf29ed05fce2343645322943909ee0a51a9a4cf0268

SHA512
c8bd58d414e4d6d78662cfece3ed625fd1cb4c57e835dbb1fd1715e59474495d6dca43cbb88a6c072b224fa3b9e0c8b4603c9fba7f1d75614b96359f25767c61

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8dd3a4ed022eb61b80788443b8e04114

SHA1
69be4de44e55e7cf3a4c9c0728d94eb3d6f119d8

SHA256
d4b42c27ccc29428cc7090d32671ea024fce12ca68397f2ec071f3cab802e73b

SHA512
17dfe2f8914ee43c0f3b19d6aa74a7451c32769f4d331e752785112fe0da200415ceba872f451ab0df16b4fbced35c2c97e2f3803a0d2555911185c813ffae3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8014075e8e39fca3231401b48ada3f33

SHA1
2672f6971d85fec3a4948b7733bedc72bd1ebc69

SHA256
97c0c29a0b32726d6536719f02bed17fd44c6a26426c4c6643ec0207ae91921c

SHA512
bb7fbc4e73291d7ca56d2a9cbdbfbe0f597780236e8420fec646a928605e318c7b509ce0500a7bfb58cbc19d31c2b9e845c8f517725d116796b3681502c1d23f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dbe47d19e7ce36542cc4972451abddd8

SHA1
13b40004acec2404db286cde35bc97fd8a485f43

SHA256
134e825d6495b3908b545816d6bf7e4d93a4a1ee7c37d93ca591056894ea650c

SHA512
66e92b4bc59557c341009eb18bd31a2f0844b6ec43b1188d49945df4fc165a0ed7068e223da709ba968f0ea05daf612247c22c80e3b4458250177968a5a1bd66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cbaed345af12ea1cc74cd841b2d7ffdc

SHA1
0954a66e025ca3b74e533449e229557741a038d9

SHA256
e8da29c6a610996cd5a571842fad0767fcf4c2b677714ac1def381cd1fb2697a

SHA512
8e5f4e1ce879648cc08d09c7df3c99b2b322c94180a8b71bf9d5d4ed42235ee95669db405bb25484304ba348271cd017e8f370779771ee64b885b4c5b4f82cb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70e3835e71189257cf75bd773eb4aad5

SHA1
28b50be418466f885c7406c60e1250aefd780d23

SHA256
2051ddf8dfe042c91ae8bed75165fea0cb035bf656a2b62bb652d4fb738c7792

SHA512
b2abb601aa88e0d3eb5363bcf046644c411703ca2d54508e150ff4ad9143e38f87903139e74b12c80558df92395808d30d164ce9ea5033237ce65cb9968ef256

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fad09f5e18ad8ea1f2289ff90ccae88b

SHA1
7884846ded52e35adb34bc7c41cf5d8036e47058

SHA256
4cdc0300b83fabe6990f2015175a73ded2948df5dcc9c260618db585cabe8bdb

SHA512
a33d2456a02ec9f90c76514743372ab9fe7d965dc842ed703b250b4ce36b1703535a7e5c48248163b24b52e2e33b32981664e0f091b1f1bc1d2fbbab90f3b9e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4dbcece100fa76efc5e3c0742f99985b

SHA1
ee44e7091b17724f6869f1c7879c60829b53492e

SHA256
b6f1c10b59ed794e02002b1d05517bd24185839b0da7177d3dd44bbb64264351

SHA512
f2a7a298b540e62633d130712149ae341f8c9e46e004e8b9af84d17d42c11db63f9c07390592fa853177452324723c3c8fbc4580fefa0881901f7b4355396a8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8652ba82857cf9aee5a61b4620769677

SHA1
ea0699cf3f56e749e9cd342c960c8f98f452d1cb

SHA256
2c07cafae7e57911f087da6769f0be90012f6085bd9199f095a7242478676e3f

SHA512
aec271925b932225270cd42d99a5e62803f4e2b77bdfbca3411aab845b22b50011a0f8220e39b61f6dd41b45b063a4e05867b02683b7f0c748e3d518b8e95aa6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4324d4b1ffaf471c73287c384591d29

SHA1
7af139c1d177c71bc861aa6965ae7ed0eeeae9f8

SHA256
86375e94312f39a073e3a7d223b647420c8b50309a8913abb5207db0c4be9063

SHA512
f6d73314c889a862db9119952595b45e39322d87b1ed75d05b447b795591ab540b359afe26333de6ce1a92a730808234d784f0fd07f9514d525c6ebce6e63e62

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab90.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar110.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit