4657c46622868e94d39438fab92c352ab33c6f2a56dc384d6f9a41fbbafa00ae

Analysis

max time kernel
139s
max time network
133s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13/08/2024, 15:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93be1c14766c51942c11a1958776f0f2_JaffaCakes118.html
Size

2KB
MD5

93be1c14766c51942c11a1958776f0f2
SHA1

ed8dd7f1c422f2868f9d5dbb5e82a6ab460aa605
SHA256

4657c46622868e94d39438fab92c352ab33c6f2a56dc384d6f9a41fbbafa00ae
SHA512

8a0031482abee9b6df4e72d4e6b918394c6068b2393308ee2c8ff00a90f4940f708b19715c73269471a729e7912b94d5e912d3a31ad90ee823079fcc33b7dde7

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000a620739e2f75d19b10a97e2b22f8e8d00f63384b96d7fbe8814114644f09cbb1000000000e800000000200002000000011bb2dbbacc4c4ed273d46fe16c11253bf83ea2c0e5ebaf21e2304625757527a900000000246c93454fc9cdeb9b0f747ad2d69ebb0f891142809f196b14b1405920fd1e48921613f3426b002a884df26fa4e312acf2746f7194b0121f5e92073b76e7a016dff5648955a4547c73a27911b789f937f37f142e948a1db7a3a9c5b3deba3c53e4f813dc642b6ee91de6b32f7e1ffab0807e5503f66e97af869a277bc85013cb1c16948df4963dcf0f2ea59efc89add40000000d04decf4a0a638106b6936479a62ed1ed8bd61489bf6050525f33e9e891f35fa881d48c34df77b3886876a8f1fe2849d042af2c405be3dbdfaa33111bed4b545	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429726104"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C510BF31-598B-11EF-B65B-6A2ECC9B5790} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 601a4e8998edda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000001efea82a0cd063a41c35448b754d61d86a14a988e707d07c3839ba09e1f5c25d000000000e8000000002000020000000e57b7d350f7adac37f005a149229eb3344712252ccc8a2941f8b247c6c4548262000000064580456f4b1eeb3b79ed4c498266d70adbe314d3b839ad0acd75a2c8adc08cc400000002f02be2d8718f2a52d032b4bae6ed90b0bc4886d8d60db6559cc314bcd5cd21f7388e2502158714afb4af36e6428d51de6956890c59dc6435c45be92f3306c9b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2700	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2700	iexplore.exe
2700	iexplore.exe
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE
2840	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2840	2700	iexplore.exe	30
PID 2700 wrote to memory of 2840	2700	iexplore.exe	30
PID 2700 wrote to memory of 2840	2700	iexplore.exe	30
PID 2700 wrote to memory of 2840	2700	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\93be1c14766c51942c11a1958776f0f2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2700 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e1afd1a2d3ec9d5adc8c0470a1dde978

SHA1
ada25066003df9c0fa8f573896f35a0236063ffa

SHA256
b63baf1cdf42f950de25b3eabb9fcba42972344e4592dea5347747616448c2ec

SHA512
9b1d313f86f93bfe684609324f76933fd34b273756054bd34a4e0dba633310d21ef543b4263cb1470e65c826008973b7271a5a94330bae40d45975e60bb2f795

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31430c7f6623bc733c1df2b50098b151

SHA1
663b198e570d4a5a85aac709870a1baabfa3f72b

SHA256
38697cbd80774f4ece4c3ae12dec4b3c923e0d773b8feea25eed8540cc97d306

SHA512
64e7bcf6e4fd476bf8208aaac5854b3a0d9519f76d8ae84e2b23d0f38d3debb6afec5a1a69bd06447aace8653890aa8a9f1326b36a19fbcd5107cc1f89e907cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10a9a883e82762a3695da935ee73f339

SHA1
d0b9a6809564fbbd97e25f5d942e757b3c0311b7

SHA256
96ebd3eaf2783a2f5652ad7c3750c610069936c1eb9840a54e35498ca34ddbc3

SHA512
4952faabd5899d0c498871cc17f0ec02213f8184a3aa278cae99a7270f6ffcb5fc233952eb7405916c12030a2e2f4fc7bc9fd2762bb26bdcd3d95dcd8cee4e26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74f663e9d60e34350cf303d37778a660

SHA1
7897924724122b28c278365d7cd6b688bd3c520e

SHA256
5badcc9b495c345fed42c97c36b81ea52b16342d10c586dcd8b5cebb8eb35e62

SHA512
9e7c758f4d2f99ada887bd62cc39e33394a27f014b64b8def01e16ba8afd7a80c48a24f24955971fb70749180b5c1415407ae07d931f31d1ea8c02e34ac0018b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e80956e7600ed5e4b7c1222ee07b019a

SHA1
3f8e871ca33489cd56f69efa02456f33993817ee

SHA256
7014353cff24d0ee3b97e4e2326b80568cd4012b3f55ee8febaeb6c1392a23a3

SHA512
042254c145927c72bc668ea1f41b9103e168ab3acb54375b623836f294a460569878970e0072b63c125e5f426fcbd27851836e143c97cbbd9977eacfbba54d9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7132945d8d7063bc164c9774de5e0e0a

SHA1
b70cfc8e837b81ce4ae1fb079943d6cffb12ad07

SHA256
f95626163354d033dcea0016adf2694fb86a0137a26c5cd4a54a2d848762296e

SHA512
ece24b5576d5507d6d626bdb4761ed322565913a7b960964e130759635fb7e8aef93d89c7fb4ba6852013bfb8db837ae753d79cf665bfbd5754788024eb18616

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e12fb8e6f3783ad9ee053f2f36985b6

SHA1
4d36934e04f1427bf3506d502c37442469535659

SHA256
2a15fa6d60a578615a4e923b95ed36547c837c58bf9400ec504c19b0b52903a7

SHA512
0b033642d4e0dd6def3c098e7d2b07a1d8df77a66b430e9021c58f85705edccc930dfbfa3732e5b6dfb386cdd2a711577278c0f67b0d2318be95a506b0eec4b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fbe7fee73f0d0c1691358ba31cdb3a1d

SHA1
4f15c367314c5e1307b3fc89dbc939f5c02f29a4

SHA256
d7b23dcb5140a7e23fd879305b571d577fe6cbfdc6fb7408e3c48bb5801d4a6f

SHA512
fe60ef2ced3ba18984e857850801a78a8f7f67dd3d252eaadf8c2ddae7a15e4f756682c42ecb06c895dcf06ee948ff587436e227dd1ede2d691a4e525e5e98a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e8f779e7a59ae10d7685ff11f245c59

SHA1
57a68190fea43cf5a77a2f114d855983a3d71506

SHA256
ccaff67d4fc364fe5e9d2f828a8edbd8f336772099344f49d52ce175b2e632e7

SHA512
70c6e4a9eb501bc1a99421f2987964f9e2097c36d6eae6f726c84988a83aa6ddd9b71ee34e9fbe74c0731747ad3d6c8d7c32ea2a7812d3f84673ee3a84fbfd7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
657955806232b42cbcb2109f72678dc5

SHA1
54060291ad1aea20a897f53bbc91c1ca17943df2

SHA256
531ceba3edc2f8eab5f4be595b7e1b4ae594da520707c66cb79497ef14b50301

SHA512
5cffb1ef61905daa64a85aabb52704998bfdf03f225849b635ed74d15ebb05286e537b71ac4cddb5744669ee94d51b6ef7113a2681068168f1c23f86e85992ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9A7E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9B3C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit