e2e2b055d41bdfe5f84548e8eb9abdaba37083ad22acff4f6d5ee7ba0d9f14dc

Analysis

max time kernel
141s
max time network
143s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 00:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

843ab4bf21d9649760e46918c646e2a4_JaffaCakes118.html
Size

1KB
MD5

843ab4bf21d9649760e46918c646e2a4
SHA1

e435e7471c78e0d2ff85ff96972ac3570dc87b7a
SHA256

e2e2b055d41bdfe5f84548e8eb9abdaba37083ad22acff4f6d5ee7ba0d9f14dc
SHA512

861829e65a4fa3012660ac2f1e6cb3f57b9bbcee2f2a782d2f8bbe2ac11c02481feab91c75baea6756d54bf365040a678d0ca9452ffb6eb3d17be94e72f8b834

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DB7BA941-56B3-11EF-988C-4E66A3E0FBF8} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60fb76bec0eada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429413463"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000725c95ffd7d5d4270e893ff747d83ad80eaa71a7810b63aac4f8533f16916fa1000000000e80000000020000200000009cd09e85cea8314c2a6ec81185d62d1ef70107e484a54bfba37335c72b25e2512000000033b2d3d01404eb502f817f36e55bf1617a609da3cb2d67c82013a68889ca0f13400000007c3438874fad964886b20b117026a1fdf57210c33d58b6332b69f8a1a9b6307be60ce85c172eca8fd9d877b2bbe12c51238d21937e3f56570b4a22fd5efd14f3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000e2f77deaa6350f2edb4c749ff283dcf9b330b7d9bbe0df9cfb9f1584dee13be4000000000e800000000200002000000021c49aa0dfdfe6b1e487ab90d8032c290deae2793a2ec14e2a599dde4b788be8900000008d264e4c8073b74ffb1b2c63bb05d3ea1bc7ec326b9a7a6532da561f4ef84935be8d35ca460c192cf97e005e1f85469e65299bd9b9b1dea1b4a99670954216ceaa7594641deec44a950d4950211ffd909befb4033afb8cd3d9ed5461ef1305e4a5b127097932cc735a8494ba66de041a4781346052bd7c3f6aec26d6e57f00dab07140bcc272fd1fa884e3eaaeb58ee1400000005753b2a635aeeb4f2fb822c58e59750c0da0e93aade04b0d3dd95e399c482b1b2d68489ffdbbdd99c0ddfc6a0bbf8512c81a1084ce9c5534ad105bd9f0dd05a7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3060	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3060	iexplore.exe
3060	iexplore.exe
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2688	3060	iexplore.exe	30
PID 3060 wrote to memory of 2688	3060	iexplore.exe	30
PID 3060 wrote to memory of 2688	3060	iexplore.exe	30
PID 3060 wrote to memory of 2688	3060	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\843ab4bf21d9649760e46918c646e2a4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3060 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aae071d4cd31c3d7187c0141977262e0

SHA1
62f42bc3b1a0919720d79b38e9cb7df6944ad19a

SHA256
78d14bd5fb4917965dc6cc1bcb1a78c3c42444457a726367ae9e3ca67962a4b3

SHA512
f95bea39b45846fc60d99ef45f33e73587c41b2bee8bf17ee5f0a5a54c03499b766116d92c5af9dbe34d5e67a5530ea26da035d7f4d1efb44a35ae0963086e04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
115d60106ef5a8cf47a33e6a1c42ce98

SHA1
cb39a5a3e724ad47bf63434bcae13acef2fc82d6

SHA256
47713558a707c86aa585d9cf8945b9a0a3747930c20fc393d7da13442b7e47bd

SHA512
a0ef2122e2183bd64446a845432b0ffa199c66666555c43b71501a92d34f4a7221ff059000e659c65ea4ec01c624a35a94e0ffbe56931e67e19b4a282fcf7b67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c96ba594af8a3bbddeb6d04dd3026717

SHA1
eab637df662c0af00b610e4fa0a46d7da0420b7d

SHA256
79006a7faa98a420840689c69fed6a3557611f8073aee243723a21bee99a0383

SHA512
a44d157f6bc6f5ac2a2bdd0058a5d1c00d3e3428a15c43d1d2015ad098b27a94f853ea19848cf3ff9c3ca03c9550bf6a1adf27d1d0ecedb75c157a554066b615

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3317b4038251362abef12c47d21929ea

SHA1
23a1e030e27a936ec27007d9bab2a3b785b1fe07

SHA256
fc0365b7028bc0ad47e8f9f3c742cad9042c993d231ff98eb1d1aaf8c656e9e0

SHA512
390a0d87388a6bab3ac18ca6b51e1c4717b5a00f82bbb16d1ceb770f3afea37b4eae374884f2d54cdba3c0e470f4ff71d2c123c7e9263f6e4b1fac279612d50b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce4a8050db28bcf27484be410bd4ad7f

SHA1
7cc75355bb217da38499d44193f92204643996f8

SHA256
37d5e7b161aafd344604d88f6a43032bf5adc6183f5b43e33cbb1be91db78691

SHA512
ccc8c78aed02005a73d38a202626b43ecde505532a29476349849cba8f2f148c313720dfcce8865cdf72091e634d7e797af8fc8b4f0a1e05e83028af51c5c8a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
93ac9584a631b8318ff80a4a8e1019a7

SHA1
de0afe1d72a4f35f7c3ffd819972d767ec474d8d

SHA256
fe476933724694ab1e0cd891808827a997f50faa3a50ea0592aebc892940b6e4

SHA512
0e1b1254cbe05d8cdc0505130d75e8b5c19aa31b84f5086304f504dae49ad2f88a7fcce62251a40d5b6a35f08c590d90c53b3134f5de6df1380ee08a92207f9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8274961988e0675d6b11824e912c2e6a

SHA1
d6038bab166456e2fae4c40f03835b4cc703c090

SHA256
1832b2605d99ae469b409820d74a2ea3f4b63118905c1d4b927bb61bd018b3bb

SHA512
190ed3bfb5f9e55ed1bdd7498cfe21374f8de43f7345e30a8fe9fdc434f4802d6231ca1ac548240017955d0d00b2ec962f1cbd6970dd00b74bf72d76f1da300d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0be8a22a75985523fb44aceb6940bbf4

SHA1
19f47b36ea41959c401e4dba00a3841049081bbf

SHA256
0564431263cc143e984b6017ce638d98c977b68ddc862e334555eddb6b6b4150

SHA512
a1a49a98c85252f2c4ea9b226e225f08cab96639412d57a00ce31d2acfac9228a84611c5658a032dc5d16a795408bf63480e24051a87be910c1f36e58a42830b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4ebfc9b9278ecb72d986e6181c57b4d

SHA1
0a8ce988c4677fd03b7879fa449b0796e10a6142

SHA256
9cf5b7f6b5ac16637671d491bb377920a12b26c029f5d27d10754ff1d244f2a5

SHA512
b4ba09b77f3be50557d25f25334927db575264ca12244560fef2054337cd5b79712c45dc672579be731aa051bf01f2260d7d0705429efef1a6dec6eb08868c2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d67fe721c5536aca0d51cd1362fdcb81

SHA1
e681a12bd2b72bcd7a8c627b30938df6b3efefff

SHA256
7d59004cf3619dc8f4e349585454fa5a1433e8f1e82fb31c9d89aff5a5c9efdb

SHA512
61bb31194a7e69ad74a28dc357f19471f8270c3d970d70782af5157652b6b9c19cf599d6bdeb54363e5338c5198048047085a91d3025718774017cc0fab09993

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6577b6ca0a3f01b4293d901488c3012d

SHA1
89322f9c6698f42f064e05b54f1edecfe133407b

SHA256
387954e0e48cc88f3f374592571a79c707f2bf761f279cc27ae6c710c4117134

SHA512
f3d74ceb5427810fa0db2b73fb8d5dcb3cf36ef0e22a6f0aa72e98263bc42dbe91c01aa713456382c7a08d7194853644ee162934d47472dfa43680ff7e1cce79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
abad90e87635c8db86ede1c14d7d762e

SHA1
3b48fb96776ad6da818b64ac1f0d0ffc6cf4ad3e

SHA256
92cf9d7d8bec1e318ab4b3095e54833abd00afc377bc3b4fe960a6d2ef76e238

SHA512
4ae9d26c4ca5986fc21fb6d43c4faae8993b9e0508af119604511556ca3af34f41451bceded782ea0c6821fabafb3bf6e40ed08c83ea3bb10b2dcc6a51f3c15f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\39GEHZPO\sale_form[1].js

Filesize
761B

MD5
64f809e06446647e192fce8d1ec34e09

SHA1
5b7ced07da42e205067afa88615317a277a4a82c

SHA256
f52cbd664986ad7ed6e71c448e2d31d1a16463e4d9b7bca0c6be278649ccc4f3

SHA512
5f61bbe241f6b8636a487e6601f08a48bffd62549291db83c1f05f90d26751841db43357d7fe500ffba1bc19a8ab63c6d4767ba901c7eded5d65a1b443b1dd78

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7A61.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7B1F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit