121e1e0c3ec9432b0c8780a89dba77af9e8cfdf4cea1617de44a33bf284340e5

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13-08-2024 22:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9503e62ddde584eff522bcda4c547278_JaffaCakes118.html
Size

1KB
MD5

9503e62ddde584eff522bcda4c547278
SHA1

3a9a06e83b96aa2f9a9b1680c7c5315b8679fed6
SHA256

121e1e0c3ec9432b0c8780a89dba77af9e8cfdf4cea1617de44a33bf284340e5
SHA512

bcc0a1e5063ed9eb862e87f2f0d279beba783e39939e7a6770c381e80086f655cbf1915e1fd0a57234039ed7d89ef8fbe5c58370ca734fc0c61050135d594225

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000f602e3ea8e4963776e0c29307e84bd860d9e9a781050a9099b9905d0bbfc7c5f000000000e8000000002000020000000f78671efd6c31983f35e19ab3e2a7f6152b70086a8c531276937bb81911dc48b20000000715b20056d0190a94beaa362cd575e071564fda65756881f368970e8f6a4e00440000000375dd428d4f7f1d66230df1eb8ac71329b1c3af872764dd4d49523d6eb349993ba29f1032a5d8fc127beb340dda94d383171534cc0d14a929a6abdf9c91548c4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{56979721-59C4-11EF-8BC1-6AE4CEDF004B} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0a97e2bd1edda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000002f202ca2406db03cdac8ac9976a5bcb4ad4a037fa555b9f88a43ccb4984d1960000000000e800000000200002000000052d1cb3a69993c59d7893f0b477697f93c8c63831c1803d04fdffe75827b540f90000000926a609f148ec2aa53413569cf9680cd2882e2f330c0ad8cfb5b2c77cc44876d59fe6c28139e8afa55d736e70dd3275b7707572505d917dca5863137642dd1b94d975570c14a48d1d21cdbb539ec22564a9af68a56db634c160bc3dbf911678680015b39fa3ce9718f5492b58f01d8960f5e7c00748af1c2dcfd2994016963479bd23db00007e50beacb4393d2bbe7ee40000000330b35ee04521ee2dd2cab19298ec065dd325189fbbc1bee6917844e74849604c7e1dfff4177a258391c4c7131db457b4e3b32cf9568f52d8197192107e903d1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429750395"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3028	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3028	iexplore.exe
3028	iexplore.exe
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2724	3028	iexplore.exe	30
PID 3028 wrote to memory of 2724	3028	iexplore.exe	30
PID 3028 wrote to memory of 2724	3028	iexplore.exe	30
PID 3028 wrote to memory of 2724	3028	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9503e62ddde584eff522bcda4c547278_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3028 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b2a531b5ce44a1daed94942ead487db

SHA1
d471cbd3afc84a650c275c60253179c4649f16c2

SHA256
ff27a08cc79a57cf17d0d1276f5d2e6a78bcc089155fdcb7eea41ef836e84c46

SHA512
427290adc47e60b92a104fcd44db78807cc8e6ea499c5ddd30ab2a2fac76864ce3b22f2039038bb5eac105e72234723abb88ee1c28c51ab12dfb7f78ab27d507

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d063058aa4a1c5d83a59c985e266bbc3

SHA1
db065db1bdf03ada97f462d3e8aaa2e0df0c4d44

SHA256
8d5d9d6871366cbac6313df92d23f9d5aec698937b54b85aae18c2ed77ab1eca

SHA512
67734fa398be197a7eb55a79c6c96af25f9b67031b043b6acb55f07e38476b6afb042af4d14d6e36e024931bf9939cd2dabcfbb3c5ecb1553e0bde2cefb411c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4169815f5cfe488aea14108f228a1712

SHA1
f796b129efbc5eff79c76bd48e2fb39fd8b1c933

SHA256
0959ca26eccd3e44844a23553ff843699d2666e6338b2e9ebdf125f07a92ac2e

SHA512
945e0b83a2c88e235dac341b8040c00ed7973c82988a1a03a20cb1804a37dc2f55436148c4edf993c5a6921867cdd17d14857d2b4ba3e0c1e5cbdc06d9a389fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad6e4fcb7ee7fd902e3a271e8fe880dd

SHA1
bac80a00fc0effb58f23b5f225538b1f6812204e

SHA256
2536c0dc7206a59b8536df75d2eb7ac72c7b662579bc2fa11f5dfd6e55cdf2b9

SHA512
205cd1e6a9a76f27b5a1d8fad49ce8b7cca7a7802386c0d946d27fc5ea2607ff8ff63aa38a5c1c8a92fe478b5cd8bdaafd608395de2b71d206585df30aa14d62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1e98a785bf72d32701d4116dcdf7d14

SHA1
4fa960e3ee1034cc5c58008f3703d3b85d94de9d

SHA256
6909610b0269ed4c0645c58e2e70e70e94a75bde7e369b22e40a9459cfd738b4

SHA512
a53a196a12f426f214e06c71863b55a0e935152fbf2f16cfe0a5da685a6771098be6a5ab702b691e37c34a309746e6f16699fda7cd2c1abb6e23b62ade48a879

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7411da6a576d1b7185697944c2a435a0

SHA1
058eff2b45ee2d382981a03b821969df33bc8dc8

SHA256
743ff54b8bfe42fd3e35df4b6caa343d0b1836153f32f732312ad465e207f4d5

SHA512
8f3a2c1c591fe3d68f55ee0627b2fb8aabd39f0c30d3014e426b586ac119e36f9c21634aeb02bb84bac64d1ea7ee4ca5c4a9cd0f5ffed1e1c3080cdd4ce2710d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a1c42bb9ea0a56c596dc7fbc77aaf39e

SHA1
6d1ab5d9a9101cf2db145f44f32ab7a7f522115d

SHA256
8f93bd814ae97cec759ca17bfe99ae450e432ee77ba2a3cb5822f82a08f31da6

SHA512
abde8bdfe867e3fa39c94809eb7e9e9a008459cafbf88c22672d10f5a7776b9d45186aebb00396bd5e459d2750add0048c7d0ee67eabdfb0a720529b35a13edb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c42827087fa3cf94748bc7097435f24

SHA1
c8079aeda5c540a649bdfe3a9966ac333f4b0b4d

SHA256
dc46d8cb60d4820a12531bff348dc9cd903547d64e2e7e5ce079ba0f01425cc4

SHA512
c377070c7a5f49e799d695be99313f29afd644735df47aeb6d184a7c0e80f5e51e94ce22f4421ee1fad5e1bb0b81093966c4ed4cfa358a6691372ea6ad52c3be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b18f31ed85482823e87ae3d08f31d856

SHA1
9a3a162141e89f42d02112e119cf5d3f04b828ee

SHA256
471fb810d11658449482561a481b76fcbc8edaf639f7a8d586e824ba150235c4

SHA512
18f24046c967cd23efbbc53ee2c320dcb40f1a8277cd7fdc2b607a77eb52c89d57689854681278bd5ee7492e17a4ee62c6667ea8df60ba8ab66a87e8a1012c3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dff55553b1600188542134ea18d9b7b0

SHA1
d0f746cc434209ba916bf4480ec8f559901b3973

SHA256
083de5c1dabbfd5b4430cbff0c96c95c0b257bbc78113efaf1d9a2ea444175de

SHA512
325176271bc48944939ad3746f4f52a5a0c726e7843fc0a66df6f3e1bc0adc16d4f475b3a0314914df0e1bfa1e090fdd8ff410ae1e9e25c911914f99af1d9ca4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
166b6a2e98ad5644c63a54a82a9417f5

SHA1
2ffb5bc77168afdf7b4c6be1eff2c86497c72eba

SHA256
59a4210a63b3c67b9348efeeced3a46289891fff14fff3271e56e9b8ed078a19

SHA512
27ff4f086ae0a81e163e8e4159b184207202e88b7ba36cc36aa0c9ba3bf8bafc36913d057297c6a361a1628656fb1b21c3d325dfa37d8ed55faff86c13fab5aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab939B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar941B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit