d841695ca13ab869e097c9990ea6f972e462aa988719e52d55eae2d880aed142

Analysis

max time kernel
133s
max time network
129s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 03:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

84b193e25325cbb8943d3892a400ed24_JaffaCakes118.html
Size

1KB
MD5

84b193e25325cbb8943d3892a400ed24
SHA1

88017f935f60046067f55f76533df1c697893eeb
SHA256

d841695ca13ab869e097c9990ea6f972e462aa988719e52d55eae2d880aed142
SHA512

f346a85110c73c8f52e2cf6043d00f541716f36e7a14f693208ed16a08712987173bf172e713fa5114ba265179033b15bea8c458bc2371067bf51247193737c3

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000008e198a6a60b0e0bf27043be629c9f0f0504d2123562461ebe662c90a1a82602c000000000e8000000002000020000000400ab7b16c7410bd414ac4d4095809c8a20e890f2b77db42364a1c6a11bf986990000000fcdc39a73040d1393d420e2c08961a0e343505e61492305c5c760fc7ed89a61b99cb06bb4c5d682f2fa411122320a8d63dbcd2e823707ab50fbabc662bd537b468a16d6f4e37a1556d9266e10fb051dedd2c36ed3622f3b9b1c2b54901c4ed1aaffa4e6f4ce36f5d745401ca3b2dff63a8e8a0c80399a2e3c41ebd59dbdba16cca6a078b61ae811292d7cdc9a5fe20b74000000016e35ff97f505caf99834be5840c93ea1a4a17764bc334c2f3b51d26dba264c133906bc8cc890b39afe54a98439b11ffa2bd8da8f74bc9bea2dd8bf4baefd038	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6DDA4E61-56CB-11EF-A4F8-F6F033B50202} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000d0687b619716b065f2ee48b6c4ad5361499c40ad8241d00bb49cf2d280b5e772000000000e8000000002000020000000e27ee123230f3910cc1b45e39d826d09868a4419c4d53fa0633b788631e6c414200000002031677fa026ecd2df9759f8f32cc35e2204246bc7f6fb21fdaa594f5e4c10e3400000001a767e7d994ec21c5822c7cb60f8c2f0aeaa9e7d6b182bcd7a4bfd5935f2d7ad0ebba07afcb90bb41e3c7f89bd9a272bce3f08d99adc11f59271f2e1ee8c5928	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3058d642d8eada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429423587"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2544	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2544	iexplore.exe
2544	iexplore.exe
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 2300	2544	iexplore.exe	29
PID 2544 wrote to memory of 2300	2544	iexplore.exe	29
PID 2544 wrote to memory of 2300	2544	iexplore.exe	29
PID 2544 wrote to memory of 2300	2544	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\84b193e25325cbb8943d3892a400ed24_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2544 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
338988fc4a2754f06c69a3c7da6a61af

SHA1
436e027d9b99145a35482b6c86d4e05af8dda4f1

SHA256
565e661943527a93d5b57e37f7558cbc27c2b6c5ff48a0cf1d26cc4adb764544

SHA512
2b50ce856cf9c4df299934ae7ca2f7fefc41aecea8e32c14e1338e4259c51ec215c1419c8e5a85087ce92ec66510ccf4d8d006e0aa52817c705f2440bc4e48e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c958d5049a97cd0a9326df05f4885254

SHA1
cf06900abb7f3f997b84157c6db126fd1fb2a5aa

SHA256
c2e95502d01c0d31b0ae0238d0f06094f9dc45927269dd5978f440cd18cca31f

SHA512
64eb3f62a88f05d746cf1722e389faf83468edb9d58c2a29081b88a0f26b1845266518cd464c14d9167c7447e20553ec73af201a5ef7b27e57b9cd31e1f9a580

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53fb7a001a42c59b7833b4fd53de0e70

SHA1
b4cb3509aa83187b1cab3a1738bfb4c99e73f949

SHA256
161baab3eb6e10298e7530fef4be25a676d53034d33124bf99e30ceac67ed754

SHA512
cd7a2dfee7d2f42f146e386768bb8c50f2894f9bc361c761ef119f66647b8bb47cb05785a99bef8447daa06c31eab52ec0110a6037ee141f4c4b371db901fc7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7fdb23b720c06a570c2b138a62fee541

SHA1
98068b24b74d6af6a9ef5be2a89746af5b4c341f

SHA256
b4baebb3d004e0d8447b61dbd46fba1a4c94e7e124448973d85108ca3cff56d3

SHA512
0e35b7e3b00d3207b4185ffc73bdf454884dfd6b9e5f0682d08fc2997a3a0486644c4ea0d2f6687f490f3365fc23cbba486114cd64f6180e1bfc835c4bb0b810

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5768d4dd32a819b6a9adc5db5b327a16

SHA1
b6bb2978ffb00e9aae8f8fa5f1b372fe5c49405b

SHA256
40cc23c4eabd6c12356afd7035264ef193b3bc296e3bc4b65c0a9fbe61093dbe

SHA512
3c6559acc5e5b5d34daae593b0762a89c737c4d533399257637a5dce5ef0110dd51f2c4cf1a62c5478f6da45ef78617ab6ee07f4d164fb66d502a7fd586cc054

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8aaae62531e2846ae462dd3a104b74df

SHA1
8ab3bb41e59c4361498a413b0a09cf18bdc98857

SHA256
2527778cd63b56a939f8943562673b271d062c5017cb4de56cbbd7612e3c392a

SHA512
73bb010ffd9a5520ffaf2497d0922581ac13eb9ca70b0ebc43d071dccd136ae11911986cbb0fe1d59ab9af772638f95507f40b99596e468921670ba0d392ee9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f862b7ed64d23e61b9ba85bb612e5527

SHA1
c27cdc4092aa6e5754143ad32b2ac135ac272ba0

SHA256
b7d8650c5026e6e89f991040ab5f4c76fe51dab403de55663a8227da571cb083

SHA512
25f77d94f56232f04a28e42b6dcf03dab65637ef714deed3db60fe249d457c5bfddc01ec1cb811268a0362cdc69986e0e1b3b42decc7782487ea216ba706c5be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee5a021c5fe7bc42501c42d27b9a1eaa

SHA1
c045371ef5fc397744cbdd8221a79bf65ed60fac

SHA256
9f30bf99982caf256d15763ec0c833e7faf3f0119b865fc4c8d18f3a98f6185a

SHA512
8600a406641519a897557eaa459ec190ffbc9d49d140dda11ba4f529a0e5e1f270e3fbae34b17de495a02af9b8cf5ff88510eaf3dac10040bfce7df1ee749b88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70f49320faac11109ad465601c676f8b

SHA1
994a462ea1ab604f2b42d8153910fd5df347a3c2

SHA256
079ee5edc5b348a97c5350c531f2006e2a302389c5a19b021ee5d1c31cd8f875

SHA512
92799e88fa4638021c2bd41eaf343ab54711730214f7aee007d78293f0f694ff89b9d7407ee6bb07ad1fc155266657a58055fc788470bd51be82c17cc6da9d11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ace76ca309d46781907e744911c1eac7

SHA1
6425c968a765b7ae5ed2a2a22a7c15d328e510ac

SHA256
88b8649f7cddb469134d0ac380ac70ae31724f67cd8062afc20e1e8640c5643b

SHA512
5da742d6b1b994b7ef1c6cfba30cfcf5966f2e5f4d0fbe745b29a60a595a892a696f6897e47803a1017fdd82d8d8dca8da6b05007a806ffd539ffadbf22e2715

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae472a42cd74abf9c349e96c0cc3080d

SHA1
d10ccbbd368cd259b566e1f87d9531daadd28a32

SHA256
6f01095958287b1614c2aa08c9da0bc7cc7b2dbe03be397563e8084c19c74094

SHA512
fc23722c3d07bc53311a706e7e6d389ea4b01c7cec06ec58a463262f23c5c1b641319eacd6f6215370359f2fcec77c1ada58d98dcc11e8fc16113ca6d7c55de9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4b7767df5034c1577ae9bdc13362b11

SHA1
9856bafdc99b6ef9f09be559617851791c8e1d5a

SHA256
07830fefda6e2bf4cec7a2f6ddd777e28a7696ac57f4eebeeb1a8dd0c07a0c07

SHA512
2f10f96504fb606c9254da7ede33e6daecc12c65f2500343a946cd2220ff17fb10a906bae13b4469c6ef1d98263428557e440916d6e92839692be72c282ec328

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c83d2a81b1b00b32af75f58103d5ee2f

SHA1
c3a4c9f2bb523cfbb8c333cda649be458197e120

SHA256
a7d9bff9cdc558dc33277ab9fd2e5f3868122fe102aa921b2a7153af11e412ef

SHA512
1adaa5f46bfd0c4ae7a21c436d2f1e3975d1d281bb282e978500bd5473c0dba1a5305a6b7a6f2d5859944a5d53a17ed80841e36776c35fa587f5cbbf074d6f7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05ac58201f329fd06fa5a8df25906f6d

SHA1
81d410993d45b8ee7be65b9803b0ca0fd29f3e7b

SHA256
e9a6574ae8dc7c2b9bc47e94d1dfb6202c8e7d42c44f75d2d733ff45755bb435

SHA512
d21fcaa82d959e1c5f07885f5fe35650cdf8bac1e04edbb9e6e506a2637fb5459b54849c0e76fc4b06b45e17aa7504350c95e1dd4cc96514561a15092286ff56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1250c3bba559e6f59ee8c7d2b9a9b563

SHA1
982dbff499798c3e0451e4b72430d72d191d7163

SHA256
007b63d53b6eb39cb8ee480dc9f603e7737e5b96a38da728cf1719753221e627

SHA512
a0d48f8be594bbfccc9901b3ac028222487df01e34d22180acc1fd9670a8b3f3a19727c525b2d1534df174b9bd80a173bdb63710e1f29bcd57480466c5a6fa95

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF94E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF951.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit