1071784e28e4a4153ff6dbf5202866c994bc7c1cf37f08f0e878fc160f214008

Analysis

max time kernel
142s
max time network
152s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 08:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

77741e366652feb05fc0aed64c775f46_JaffaCakes118.html
Size

1KB
MD5

77741e366652feb05fc0aed64c775f46
SHA1

bb2aa4fba07c1bef36438f3624e4edbc38ffe593
SHA256

1071784e28e4a4153ff6dbf5202866c994bc7c1cf37f08f0e878fc160f214008
SHA512

42ed0c5936e0c2d51953077be711e7a08c4f994a5243396228c9b1499ddca85239ebb3aef067d19cb769bc1ff76b4f4b396a1298e7e5fd44dc9ec514f1ddddaf

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A1E81961-4E44-11EF-A173-7667FF076EE4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428486083"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c0000000002000000000010660000000100002000000055139bab8f289cd55252473b597421fe5bfe9209299e3300b53494a658638114000000000e800000000200002000000002048e195d17fbf8079b00748ad313c5ec81d5176bf636d2070bde04561f8b0220000000294a3f6549a77c6d611e314bc36db04e4b139629350fe56d3ed4f10595987f5840000000f94b9241332ddd80c6310560ac2421722005545770fe18b3a1b9f03e402590d1e75b9952bda2408fe8fed77198e88dc987e1672db153a2e237325812cc4cc169	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0e5cf7851e2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000044d119825f38fa43a18619d936383cefdf6374b7212ed9b506ec67c2c4fa7c6000000000e8000000002000020000000cc342e6d83cdf3192cacda86a305f0a549018338d61cd44344ffb267d5ce9b4c900000007441eec068fbce0eda06217e8b22d1d07fb9c45d63e87df64abf1c0be2736138700945433d054067670c4522ff8926bea17d891dbe3b2ffe3a0ac26b8d0e365a2af7cd9e2b33ac03023e03a9ac4947235145722264d6fb8bd9bac12428dbab57eafaa3c1cac0c5b8cd7549511ad62a65d03edf11d39f0e037418de0065a3f3c2295662f3ae61a9975f23f08f1acd11d440000000cdbcc11c4ae0e7beeca425ce9a6174089c085011b137d7e827c74d52f2ce8b27232d493fd6a522f30f1d528cb3f8da32981edd872e4035fc790668828266830a	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2112	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2112	iexplore.exe
2112	iexplore.exe
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE
2552	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2552	2112	iexplore.exe	30
PID 2112 wrote to memory of 2552	2112	iexplore.exe	30
PID 2112 wrote to memory of 2552	2112	iexplore.exe	30
PID 2112 wrote to memory of 2552	2112	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\77741e366652feb05fc0aed64c775f46_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
554133bec1dab3efdae96e7ef334a792

SHA1
a96bc3ef3ac10d7f0a170ab0c6a49b3fe43dd4e5

SHA256
6a6c079f55dcc2011c340bbd13de83495d3f0dd0279e6fbe9b6801b9c2a9fe1c

SHA512
21ffe57f6c661ee88d26b4dfbde4d265c492429ad87c8a08b23f33833af0913e3a8f876ec1263b31e624e8dbbb1fbede6f2eafd74bf18e15a30308e54f5c2ac4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c7433095b328762139f6b67ce19ab0c5

SHA1
6892574627abc2ab75afb0147e3eb091272207c7

SHA256
ecdd45a6d2b20aa63760c3612952676f7dc7cdc25c0f38b5a2e4648ff34fa15c

SHA512
1324455cbb6dcfb96bb9e672e4e20c18e5c2dcb8e1171bd3fb917b369d262111f6e30a24a18fc144461fa8f0512c477a5b5e8d417bab6e08c2b5c88e7bb39830

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
39cab064a020d496f5b4da4d46dac2ee

SHA1
078ac014863401230c6d540a1e0cd36756b8f4c4

SHA256
42215848178fcf741016265d8f59f1d06cd68d749e117ea191e92aa83588cb7c

SHA512
bc262e05dd49bdf69b7f73f966cdb828a051fbde3c863bacde07edb72809677067801fce774fecbf177cd027b846d7f71859b4e0ae3e02505d4a3b1fba695f74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6c5eca5a185ea0978e91ff88d196ae43

SHA1
022e77b0fc1cf6bcb859daf0681a58014db58987

SHA256
539477a179faf7a170528c2224d76445102178b0cc91d3fc92b96193abbe1fef

SHA512
642b8005a47c78aed6ec5444de6c455ae4d393ecae0d4de7c2c04edd59fc4d6181f6ecf8b3e79de0497d7e88065f7b6f6df079895731ac4112f15233c00bc3ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
68913f9832c268265104cad9fc1d5182

SHA1
6bd3664d9d52ccb70549efe172a4728aef65cc8f

SHA256
36c2ad1411a6598fd75ee085b6655aa28da72771f5d0031e91ad3403ca7dc784

SHA512
e1d856523972bdebcf0137865cf4be5ca1b49bf32746026ab0751ba9214c68913dd92069d9bc4524032a51da069cc1373d895f9ce5439001afa94102e2d00f2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ed149892879863f41502abb8d9d14570

SHA1
e230de7e97baadbe953f28dbc331d8896d38aeb5

SHA256
7cccbd97c5527371c28b0ad58fad0df69292bb7c1e6182989c82a4a1470445c8

SHA512
56b194166c5d87c5b1d51150caa2d8e466d7d089cc66da99b422cc57ddff38b9b33476552c95652f0e2f96a011a10c6551b2e9a95d29049a4fba94a896461404

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
303af517c676621ec283536805060d27

SHA1
c8b5368b44ab986e962eaab6e34ba6274e4cfa55

SHA256
f8e92d6a2f1e46f93d9dab72c29ed546af2c808827d5a282fafe26e7d9df35fd

SHA512
f41c61476f80144038e8341c90b2bd9d417d0c2fc7aa67867baafb0940dbf59ee91cbde7a7ad7119a1000dd18d04160010d118d21781ef6ba75832acd1d2b42b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
20ffddb8f7c3e0430c26bdb7f175ee42

SHA1
0782eed0526902652ac80fe4d65d8d623db19743

SHA256
ffe3fd5c641110becb692965f135211f2a576c9edc50b00437482a7718fa24a5

SHA512
c1655d03f002b3faa5d946252a4f3f72450e2b580f8ca5a34b43345d5d27fee1644d23dcd9e49fa933dc06d16add3fd429fc09eb0d265830efa186e6aaa13b70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
052482ab4c8c7270913ae145743219f1

SHA1
b0b783705196bd02232b87644c7f1f982fd44e93

SHA256
33bfdfdd611634ab0bbb1fc1650d2c5b916fab74363d83bb75fc9e29201b9f6a

SHA512
d55dea993c5adcae301f1104cb4198fa2601a60d87f1abff7345850d835c314310a2780af036c94e1a6cafe245347a16b925d524eaea26d05d994da8cba183e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
4421a403e6dc610e97b6fe264c833e0a

SHA1
653ea245f3a01c36b61c513db9caa5bc3368cba3

SHA256
413c010a5809f841997b8a68513deee324038b71ac6f839f2559f4ef73e9503b

SHA512
0793f1e1da7561871a3f74c16e95e7132a38ed63d566b5e4d8627d0318d8c623a058748218a18a539197cbc127a56a7d979d1c5d261a32d8d37a08e20452bb11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
35ae116daa116a0cc1c29e352a5f597c

SHA1
727de8111cb4efdd4483da28f1cae840145a35ce

SHA256
64abc9eb30d0035f46e8e408602385da315291ee67f533d9a2dc9fc456459bff

SHA512
3e105084b573375ef43eec1c92a019b1d67274d3dee6b17a3f06f32ae98cf8ea90bd219c5ad1604c1354ed16769ffc2f07de5ae5130aa9526300a75e01e61fec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
13f50b401adf17f50ed71c83063a1f3d

SHA1
428985a0af88d22dc19a2c92a8613800a82a56af

SHA256
a51a537b2a0999e39f2f6624ccd0d809f0d7a1c1f3901e7c020cb7210f6e9925

SHA512
337d195227c2a5f8323704ba54443151b05bc8de8d9688980a60fad6bbfdb294917303607aa46b56455e06cb39253cdc87e47fea6d5470e8de427539b54ccc4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC44B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC50A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit