1c9753925a278f26a6b0e5a1e3f6ab4868c4b99062f868f014dd370f9f3af25d

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 05:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8916cdb6d149f574ee4a248f9d8033bf_JaffaCakes118.html
Size

53KB
MD5

8916cdb6d149f574ee4a248f9d8033bf
SHA1

45002d4239f12c035af45e750e214bcfdd5d8d51
SHA256

1c9753925a278f26a6b0e5a1e3f6ab4868c4b99062f868f014dd370f9f3af25d
SHA512

bb81e00d1dabcbd1a1c32492fd19bd32c7d2a1c638818f6938ab88c977223991bb7eeb7b722a2dba56532a6ddd4dcc9efc5977a0c5fbeef5830e89068f67fafe
SSDEEP

1536:CkgUiIakTqGivi+PyUjrunlYkF63Nj+q5VyvR0w2AzTICbbCovf/t9M/dNwIUTDF:CkgUiIakTqGivi+PyUjrunlYi63Nj+qU

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000002425049c80c31d5c199cb7e2e8fdbd1fe56f57f7b576854623393d4201c65cc3000000000e8000000002000020000000b753496989ddfede1c0317109e5f33f74e5b2a92a42a773b73f639426c8dc24c900000004c075d44388a5d682bd207e7db16e26ffcf0c93c25cc438a0bf1b144e9854dc2a0d3de68bf1ea0a244e645af65c76fd27fea47b3a087fb6fa17b87ccff10717c1b3ab02cf6c38198f3795bf351cc5f3d7187163dff6e4e6c2ad33abdb47caac327ed5dee92daf445a461063577e58594f12c43045abfad79c83d2f91fdcb9a03d37569719126afd014b5d89ab58da5a140000000b657112a884f0bbf4b56295b61e4fb1f9da7e7caf0eeb97ec77abada79d793b02f722ad2f00a274af3e92120cf8cf4070235e5dcfb0535e6ad67d95be46d2a2e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9ED1BED1-579E-11EF-8A2B-F235D470040A} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429514293"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000009546b42fea4377e82923b41e32887f5511bdea8da7441dc56c37dc3bb1c82810000000000e8000000002000020000000c5f442dfa5b27a62da7bb91b16b4504394a5a9f1d029e656501b2c54b69e1c1f20000000c68ffbcb3b0ff54148292a118aa4c1743bd23980d0d804b3b2e9b9fc69e1dd6840000000ab27f08f157a86ca1baec7a02d8cf779807d5bdf3261c32ee6808f38be22f6497d3594cbba3ab760b9ecc3bd02175633ea0103acd44e5a2d0bd9446184a90537	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0a02876abebda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3028	iexplore.exe
3028	iexplore.exe
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2448	3028	iexplore.exe	30
PID 3028 wrote to memory of 2448	3028	iexplore.exe	30
PID 3028 wrote to memory of 2448	3028	iexplore.exe	30
PID 3028 wrote to memory of 2448	3028	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8916cdb6d149f574ee4a248f9d8033bf_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
024addb1a43fe57a38ce32e9fc2500ff

SHA1
b1724584f4d023f53935e9cfd344e62cfab489f8

SHA256
47517d6b84a96a5fc4001e140d2a806cc3f7164f857b2adef5d1f2d64d552007

SHA512
a9e17227d1ae6a1b8750cfd42c9cfb12926a3b9c6ebf711f406715e9abc5ce8e57bfac76785016640dad27f4b1b87c38853b755eb07f364c72cae27817310bcc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73cc71d3b0eac153e64ce02a0479a6c4

SHA1
9b2e4f42faadfadf3f0da4cdf39c8b527b032626

SHA256
b8142178fe7435fffda826e3bdfa0a18877c9b35a78ee0797de5debfd4c42612

SHA512
029aa9553f1be7fe6b6e7aceed17ec01193f39bb63a46a871e59289838fa77df7d775478f5f79cfc9f6af0cc8b001d37ab6784ed0323cdd730c2e31538622cde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
590159746ebc14bbe61f98c0b27f7b00

SHA1
b57c415336510b9da102feab4882f09e5cd6f6ed

SHA256
db30ef19ebfb65cfc94a55ba0b46e6abcbe66713eed41260a90a84d7f5bee7eb

SHA512
21bd7fdc7da9745011f22b025fd5a9194ec66c8d5de7c402335a7bf74de034c9a0b4a920fe93c9c7a8a1455b1b3a6fc17af450789f2766689cc2ee4a046a6be5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c7e9f2fc3aa304aec5f15003e11c48a2

SHA1
5f9a402a24c38f411b0f92b1555b8818c7ebe34b

SHA256
cf6ae8ff2806b6f89c144a68b6632c50aa5c80990bf3140d8453f1e8d0683f44

SHA512
bf0bf88371a19e57b477f75f3bb3237d3f6b77de5d6b19ecde56d4f621f833b1835a1ce4b7de3fdcf46e3de8bdfc2e3dfe13b80c495f28bc175cf85fed3533a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d40e451f64f873d2e2e8ffbca8585ef

SHA1
523c227127e987e7f7c40e83c353157653e9e975

SHA256
047ed96057ed4ff877f1098ca658db75e5f1b5125f9e4d23f08ea88945b3f7f4

SHA512
96677a68c3042e06a7c362d7eb3a74cf842d15d8e14c5e11b3509170d34c20360775dcd17e89de0951712d74293612c892fd031f65a00ce8601b978256473821

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80c3936e51b157366fde6dca5c04055b

SHA1
c3898b2df73795b2b35955047bf739eab66f8569

SHA256
1ac59af2913ad1476f364fff0d79fb72c718ac0b7680ef0fac3f3978eb159a76

SHA512
83a8332938e1a9e84c9af3e2004efa822c118e115750e3e041b5d735b31dcd79e7707c7c3519f50f10c21fba0b3f0eae6d8e6e1d2d85bcf453f112e9c7a8eed7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c52dd910feaeef7fc6eb2895c4ea80ef

SHA1
ed0d719ccfa69a8132c4a5146479ba6b9378bf58

SHA256
0e97629e89bc85fcd722505c6469158d34a4a1660d1c879e03ac8c134754d17c

SHA512
0929e755fd89ffc421d9cb0f12dd6aa1373cc207185e2104e0290f3caac91a12ed8d9af24b325a5125e867191da4557e1b878cbb380054a97733a00d275a13b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
693947848ce06d2cd1082417e2f51484

SHA1
45cbe6473c3202fe0540535f6dd7a97a6a5b36ef

SHA256
b499f8c2b6efbda36d84a1302e02f48016e417006f6cc3d589fb3c6fc5d4acd1

SHA512
03e4fe93ec442353ee3baaba5d00fd10c87b49e0c601820ff610fe79daaae77d0c8cad94bbf06f4dffb918fcd69e6cf7de44a5cc0b1da2d6b2cfc7ac18eb681c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c642d505e8a22abf93851597128cc0d2

SHA1
fd5e630f18da4e1787e2616bf9403a18a91aaa6f

SHA256
5740fe13a0c9c9e5f5bfe66c00e47c84df82c7f82ac437b926fa1dd68c12ab3e

SHA512
320099500dcb6c74ac18c60ede19ad2615e23d17828816d14df8457a32dfaa4ade65ae6b901d553756203ad60e59d9c2913a23c430903054b1bf289146a87652

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28260684ca50d0e24bcde63e86ea514f

SHA1
02faac037977e075cfaadb962c305658b09d8cc2

SHA256
0a7156a57c2b3530707f640a0e16823569ef8613eeafb26e9846561772288e6d

SHA512
f37aaf600e11cb84fc78e25cb1bf2a6f54eaac0832a421000c966f9d1ed06f6cd82d91b25230455497279faedf6a3c26348633b108751e9dd3355280a133613e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\5J67VDZD\script[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3C58.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3C7A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit