c9fb5e57443cdca43fbadd04dd2345cac4d2a66c5996fa6f530386939cfffbc5

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 05:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

894350f635336eb683985d07bf96fe8a_JaffaCakes118.html
Size

21KB
MD5

894350f635336eb683985d07bf96fe8a
SHA1

a564df51b95edf5bd341e6e826a220965b4e6266
SHA256

c9fb5e57443cdca43fbadd04dd2345cac4d2a66c5996fa6f530386939cfffbc5
SHA512

28db4be0e230509f03bc51d24dd03fae75ca1e766dcdd4ae746a6c211b15890150fe0db541ab90b849e905b77dd6904792f570c2d7bf08777f6be350e9c85d51
SSDEEP

384:J2XZXwX9uOJXZKh58+J4JBJtnBVkYe3L61Ha+aXQyhyYFPHR:AXZ5OJXZKDi/kT3e1aXfoc5

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000127d2ed1346ead42c8c9c176b767d835a5662be06434cddebd31a4b5cd05884b000000000e8000000002000020000000012e71ff04bb9fe3f4914ed25f3b137568570e12112362895ad219ac6c6e5f1a90000000292d51d788c8b159510e7b8ae7d6f35ec961372069c3942c83dd868a3d7e5a0e4ab86645501c9e2b9f69a4a3e4d658a560598a22f52d617c048db4a2b759762772c77b8a5a4f63ab232b3613e3343c94e4d713e5bfaca3b87875a9bd7f0aab072949499fc2b8e9a77f3f41f52713a3161210ab9318a9b8d871e7c778615183f44b5bca3823cd1ab2edafe2bf1343d6ad400000005e0f42e49f76429805369d979e66488214aad5cb157592c0b097fd5c85464dfbab5a3c8ab0955d6ce7dbdb974bcbfc0937730c2f73fb4e1016b0228fb4fc63d6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000dad3cd66854da0aff0b53824fde0f0f353da4a163f7b2e675afc66078a337b67000000000e800000000200002000000045ccb24a8fcf3c8dfa6dcfd29ac65384c1bf958e0bcf895dc771f7d3f19aa41420000000926db5ed5122a186813cfa86b82473e2c7e6d700c20c2b89850063cb5fc17fa3400000007072353616ddb7c75ea19b6060803ff59cc7a995a99f7715466f7623f6772ae15c612a60cf9b83d036d0f4b832ac82ca8c5b1d301bd590c4a76bb8a058b0c7b6	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429517890"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f03a14c2b3ebda01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{ED8DCE81-57A6-11EF-8340-72D30ED4C808} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2340	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2340	iexplore.exe
2340	iexplore.exe
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 2180	2340	iexplore.exe	31
PID 2340 wrote to memory of 2180	2340	iexplore.exe	31
PID 2340 wrote to memory of 2180	2340	iexplore.exe	31
PID 2340 wrote to memory of 2180	2340	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\894350f635336eb683985d07bf96fe8a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2340 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9174f9ea217758d55ac4cb6218871f2d

SHA1
bd174c458473fb568dfd886dadf3abd3a700f5cb

SHA256
5e7251bea25a010f79482cf6a48cc3af14a0dcd46d5422cc6387556b6698f6c0

SHA512
69dbf9b54f192db271ef421015ab23dfe5fd846fd5141cb5d3cb1fbfdfe59eccc765a668314ab92bf874a7c10247647a3d836beec4c277b87ac746dededc0118

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30357a25647b0eac35046afd0fa82eec

SHA1
b1fe8c669ffad9ba73c65ff36a57b920c254ae4d

SHA256
d848295605857ef01036e5aba1767b5cfc98057e2a414b530f5f56fa837d31bf

SHA512
d17c2d24121190c29e5c3fe2243e457f0188ad1eeb592aa0a34be2b651df4e561fdffad0b7ec9a34766046b17e3db2cc629575ad7ec2ee6ba71620613e0442d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8d7d820675122be4d080797928f4196

SHA1
3c301898aebe03ecc3310a099996dad13e667b24

SHA256
c7f6002b1a6c70642879fb0b964ac44d6edfe4a88b11dcd6875ccb445b938905

SHA512
7cbd9858557bc7d5a536429372ff183ffa7728e4255712a18867988c3ef167bb8ef5d3395d32a161343476495bba5c68cf35d8927614aea8d40e6e58cdaeb700

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17cfa7aa912a401ce92590cdd5e211e8

SHA1
ecf1a80206e7bd729616961372b7f8effd1782ba

SHA256
39a3bee23f173129f59eb0b74fd52bf1f51866a57419bd432a21e33ec2299670

SHA512
9a34cdbaae60ebc152d60ec133151df4d5750a025b0e247530de23c15a190ba6c71c5475b589a8ceef32a9c5ef19a68786fad9b30a3c311c855ee3c7e3a671ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c758cc687e27cca0e96eefdf188b39b

SHA1
cd74d820915d6267d145ac08a3504cce96a13bd1

SHA256
50151ba00a341daf39aa5111b867d414e9861c1d8b327766b6a7a5692b7ac7c6

SHA512
513db1790e7eb37625861e7b6216da0b99ba1603076846e4ead92853a53c553569e09a8b8939f33ae817b5426893e899203d6fae65a9cf6a1ee160f2ac3557d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd9756006959208ed3b2b0f5d1c02245

SHA1
68aae898971b0667b7dbf99e6157f4aeea03b83b

SHA256
322395b7fc6704d24c508c8c4f5d0f63e7f85269f80f68049c6ac1153eba3331

SHA512
8b9140ff7a70949fa6144efbe95a76ba955621e8c677df2e6148b9299e464c9def7dc8bc0787d6786e404fd6fba8a8f98693529346d104faedbe7099d8a99fe9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b0ba79c22ad2d7b77fa1667cf32d7ce

SHA1
aea8edbc8f8cf9be33bd1625a6554d6ca1ac9b17

SHA256
d8eb0b831e6e8091acbea8d54f123f2cec29e9afe910a025e92178470f049889

SHA512
73ec0a24acb280cb1503bd96df6e3fae165a9552a9768026ef15c096bb8194eec7b3194d5c8256edc37a5c9c035535e8198129f410eb3e7a83ab804c5bc2e74d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c0e4eb3d9989442a9e8bb24d390941c

SHA1
e5f15023eea56cef1e85b36295ba1078aa275b01

SHA256
0bed0920b020fe01091d932386799612c0cf8ca4c2a2b8ab58d99f6e6cf92757

SHA512
f0722340d6118d11fafe3224d40d38fd19f85e98b04a0f7a87ce2e24e46a196bb8c27ab2f4e4d0eefa988d53b6f49b26135911f9d7d9fec65af29687be150349

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32308b0d73d7bb0faccd89f8bf275206

SHA1
b694b3c8153fba9d6bfce12558726a48a7743db1

SHA256
0c3590c5c38516813429bd535e8666e4de001ff6463cfc32ac86bca626f461fd

SHA512
dff5a81f98647885777f1fcab5b41b7eb15d66cf7a9aca2b72ad3eb36fbb6d5df71ef158ab34b9c2d2f61203fd0b262a43bc5ffd793fb1a901740de1d8445e15

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3f3fa54b514b04a795e525839ac767d

SHA1
a817b254e2ed118bbdd21bcf8710e30237abf207

SHA256
1dc71ca4fd639746350367e8fd5f58675c1de7a1accb261985de728b7746a962

SHA512
c3b64c7a82077505e338473d997b7e1d3b4ed8aa20d85f0179cf4e1b1936b1da9b32d53de19539a7f2e2d9f95d4be2dc24d5bb88941a312468a1d7077c8db22b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f3ea493da533578d23680821b34a1a2

SHA1
678b81a07a9707db83b997e56b74d6bf05d90571

SHA256
2e87c8e6d0e84ddbd446c97f527b35dd00b8207635ce3d732b2527b31d3e3abc

SHA512
9c619d1f4846ec85ff3d43d5eac6ff6d9160b41afebfcadc6fef578026c7efa7a8699090e8fe9fee7e5092a058f339dfc3261d9694de32e278c9b846524d9752

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
beb2784b6e8caceeb5dda674804fa2d9

SHA1
700d63eefb224ed8965f8850c8b9a212e8d49710

SHA256
36b8178b67ed6dfd718d1c3f337db7a62fcc3cdb5e69f4d80f3a9ccd0a2ab4ff

SHA512
6431e1a8319c616acc9a4bcb27563bdf6143b7cee98f0fe16f9ac67b9836e46d376506b2e1716c102136458e6904ee794e22c7ba84e67c4af6ae446b19d6aa76

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF9FB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFA6C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit