da518d3a9dff57b5dd1c3f2072dd49b4f3760e24f1cec3637c931bb597d58da9

Analysis

max time kernel
135s
max time network
134s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 12:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

862429fa82e87e90c45e4f1fec6b3c81_JaffaCakes118.html
Size

1KB
MD5

862429fa82e87e90c45e4f1fec6b3c81
SHA1

950f019b8fd8cacfe20fa9fdbce0de445da06471
SHA256

da518d3a9dff57b5dd1c3f2072dd49b4f3760e24f1cec3637c931bb597d58da9
SHA512

8890e276835f210b13812ec583dbee7962ae85a51a70eb0b73b0e402d3f28c896e6b2eff557318bc9a012ed94db1f8bc4f8de4c7c14c442d4a453ed7cf0246dd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000b5035439b22e276d01257f2d47774948415c2a8765948be62b5eb4174eaa7615000000000e80000000020000200000008aa8644b45b84bc7a436ee0d7eae730159312d098302d19da78c5e4acf4ad83090000000d6cd6c5f4d33ab287afddb729f4282aa4c21226b588738926de650917edfa57f4d668b307241d21dfc277eda08bf60f9ce292b0e3024bd83e77ba1843ebcb2cdb79cdc606608c21cc194648fe6bfc4add151dabe1037298cf83e6dfcb352bffe5e504deef82e7cf99d63ee759039662092b3fe372383b63817802cbd48d0bf27ab344742dba718e7f6796a478fa1da65400000005ca6c98e76a862187b4a0dad9f1c7875e7f71a2c68b592f2397653e604b0bb96ed9a2dac782e16af85d5ab89b1e537b91f5bb2c66c64550d3533eaa13dbae8a3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000be5c2edec3fde5d2e2fa2208e5526c492bad9ac43702d921367456b9110b3d1e000000000e80000000020000200000001138de502b42d7ee6c62889ad37135a7c723ea64d51b29765b6ae6a29801f35e200000005ce29a115ac18c4de1a207a15ee162d5ee3c66458da6554b08910636c49e517d400000004853d1c40a0499f78be96104535c90ff65becd964a48f242d23c86a699cde11b28f99fffbe03c9cb2e94840683be7949f98db41abd6b30e4a6c7ba89c0fbcede	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80923b1a25ebda01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3772E921-5718-11EF-A74E-76B5B9884319} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429456570"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2928	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2928	iexplore.exe
2928	iexplore.exe
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE
2772	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2772	2928	iexplore.exe	29
PID 2928 wrote to memory of 2772	2928	iexplore.exe	29
PID 2928 wrote to memory of 2772	2928	iexplore.exe	29
PID 2928 wrote to memory of 2772	2928	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\862429fa82e87e90c45e4f1fec6b3c81_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2928 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
169f65160046958f3d1e47e295442de0

SHA1
59214f53b730cf9cb0805b74b4c2a06f51148e8d

SHA256
206fd1fcac78fa3c1f2a5e0b5b77b324270cef30e940d28ae6fa2692535cea1e

SHA512
9ef9304154cc6c3ace5fa79cd50c1705360fedefb039b935a979c6580a03679973304bf93a7e9178af28837df2dd344252e60377e6a663adb2805b4649d9116c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98fcfdb7de268e2b3082ecca5b94f644

SHA1
99cf0f343f1f526c61fe3c371e9119e3e52a8520

SHA256
d3eb282ef719751c0f10e3e30bb03b88b2e4da62ff4d50f71116a2325cf70f26

SHA512
23de582d7a623bdb4f115c26fee5eb8b747593459cd77eb6dce71ec54717f2d77117db391b67c91c9204a4aad01e7e8193e97fd122cebf60efedecaa158fe68a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4831bcb5ad88966066fdeeccc75639e1

SHA1
30ea9f5f2b7cb4292d7b5b8992687f2a096988df

SHA256
443bde3b4d8ae983e9180539b58c12ecc1ea73497a04ab89b509bff6141e0e41

SHA512
a4a0df90ea21a1182106605d08d422ae024306b0205c7ec25157c12e6a9f1afa8e02eb1b48cc4efab27da1a498b28e403072de2e5637fcdbe2433349d0c8277d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e97e84bcd4828d81aa331a2bd6e2aa8

SHA1
f83580dcb0663316b8e7a909ab47206d08966c9b

SHA256
886c20b8800c5ffac3b3c859bb38056c0d7847e01ce09c0a5ff4421a8406f41c

SHA512
ecffb7070b355145cdd0b505b43e9ff696b33e9283350d80641ac8d027dcf6851ecaf1baf548bb698fc9b1cdfe064bd365bc4ada433cf35a3813ed58ec15f822

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db4195b34210365fe68eaac0ede9c1f8

SHA1
2b6b4d4a46ac09fdee2529b246790007e1cef5a1

SHA256
e41925b1075bf0bdeb1a0501981fb92c77eef7984568c4881e0aba7200225baa

SHA512
abe64e2d42fd52d0dbafcf1bd157cb471b180560562a3dc2192aef3002b5e02bf5439ea238e68f65c10b58b09e11fe53f1e7fb75a62b8fda1d7c09576f7b829d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35a60ddd5d0b4693f38e7ecd6acf7072

SHA1
7db50278ebe21987056e46702b85fec72aed64cb

SHA256
3c752d0e07f7b6f5baa72067a5e3f83975c2639406b590843fde02a08a411bb2

SHA512
37bb3d87f6ba710e104ec0ff7bf015db778d9379bb3893c3aff321965dce21e4dab966cdb87fd4b7e3ec316c53841e9b7c58d916d6f83f95a93ee9409d3ad102

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f3d592b31ffda1a65423e90549a53b1

SHA1
1c5afa3cf15e31629114e7f68153168bd2c3c48e

SHA256
0cc54ff05b2483d08607493e5a3a1730e9ba8944db46625174695e279730e410

SHA512
ccf02fcd0fdb82ebf7e5632aa4accc7a0e7aa4d06938748f6f21c634294e8e2f23f6d638c5268e46764e7200ca544e14de69c172bb5fe2c632f032c046a95887

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a06649c011e04f0deb0eca0fbcfb615

SHA1
c9089bcc31e92871f57079370136a3b49af2a08a

SHA256
2d93e5e691f112aff672b7dc105dccdc52fd3560ec0b43f3782e0781c5cd969c

SHA512
04323c2fa69108619279cd8e651ba4e4cf6b5449bcb17642418b845d04c0b4207a764559f0585ead481e10171731d73baf5b8725c51233954437b215b7249003

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2b9f0032601e34d1a51d444c1c0a664

SHA1
e530d6281e176fa85386b47d91c3cb3101d53ed8

SHA256
4bb9638849e609b733744d52a55b8fea4d3bda8e1eb5c5e0d31b57cd34ca5a17

SHA512
0b7b05b72f1398eab421dba00d6de3a86a5d347bcb971745e78a7f60f947b922917da0ecb8ef68807f5568597a6d506bd6aacc46863944ef2803c01c921115bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dceddd1f413a8c946be05eff5e041c28

SHA1
8bf8c8d27be760f41ee77bc23880d308b88b2c54

SHA256
bd8423722a47d302dee5c1cbc0c654b40c653a4b0c4d34543ac56bb692dc539b

SHA512
aeaf13a6c9102c04634884a61f0e67539c2d845d004b8d86714c4e8b1a6c4e49b164af47293439018adba9888cf247c1f95079cf0095d6d2fb8c6af111717b8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ce5e16a263c13804aeb82eb63b27d0e

SHA1
1f788f47ce7f3021ab04baec8a79602b8641f889

SHA256
b0ad8492e25b87f9d2cc404490b99961f05230c85cd5db47c3ac385aecb7f47e

SHA512
12147070188a9f2aec1517d4dc810c96915a17b0a738dcdcf29f5cad094fe9a5ee70c339c28057981ddab4bfcde7eb4589600eee34de35116582cc955c776cd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea0ed3ff48c818409a51bb1f270e77db

SHA1
7997206112bcffb1adef5293ccb8c4c93beb589a

SHA256
59a25f11b53ea95a477ed7539f8929511f026c1bb9d5291b5f3124891431531f

SHA512
e8d1b0952d079a5cb86ebd43debbf167500b743bbbbbadd77780e28ebdc13f486ec0b4e6b004f15df49ee20207f35174c0ee41b9e9c88598cede9907132ccd49

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
624ef72adffa3e5661ba35f082067b65

SHA1
a31341d90253376d45eb3f4c62179c3fbd1ab09c

SHA256
6cd08b31800592482c0e860b1993ba557d943369f3da97f167266e273ee5fb87

SHA512
2e3818520335959ce0e8a0a22386ba5115f53192fec32e2600087a38ac018651ebd15883de842111ecdf33be3a58907dff08880e46f3762fc9bff1cae3e2e36c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
752745f7a1170e48fe408814a8270f28

SHA1
1f9a464d98095e1fb2c6bd506be7c64ad2a7ec0f

SHA256
c3f835485503d15e9c415a4458ab2ae25a7f52626ed43c93e94ec8343f6dd114

SHA512
78aed37f4919844279f97e1874eb02512ae11db9b9f34578c85ee291746b0bb8aed37ae0c9d83e6dd719bce32ae301958a33232317b8aae61af6b8d868fda5c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd5e0baeab5ae39d3e0a68b2ab68dc33

SHA1
08741f9a3fdac40513fce89e9e0a8b3a3ea80103

SHA256
0250a96fa776b146db13399e47db384494d323a10f0a27b3215ffdcdfe011e05

SHA512
ff85f96f2c105de612ffa8013373b4eda2e5cc44528cfea9fcc3cf024bab0cf9a0eb2c499ebfe43f74e16e62b3cae0407cc43af9c87a3eaf3c0bf5b365437b95

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6367.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6464.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit