528b24cd1431d2ed84a5e643a3a48cf0fa7995f62601b1a48e94a8cbefb9788f

Analysis

max time kernel
121s
max time network
134s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13-08-2024 20:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

94b35a7ae1c06ee68dfe940347fb2da0_JaffaCakes118.html
Size

2KB
MD5

94b35a7ae1c06ee68dfe940347fb2da0
SHA1

05b10306d215c8950c3ea2854aa8d4c186ac7645
SHA256

528b24cd1431d2ed84a5e643a3a48cf0fa7995f62601b1a48e94a8cbefb9788f
SHA512

03750479bda771afa11f84bc29ab8dadc254b57e82480b90ef3ef6fab6f08b1d8366b47b34f88d60a766f7ca935ebb558dbb053c5be7bd2008c1559b724b9942

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{757E2541-59B6-11EF-BD32-F6C828CC4EA3} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000888d4858027a30744f6fba133894d0155746b9d55e695ee93d02709788bd010c000000000e800000000200002000000068e745fba8395473aacd2c710eacb9c794fbf2084bfca0093e3f43192825372590000000292094bac310cf958c5f389c0addbb7f225c648fa6951478c71fa89b8115c039b8361fb7ef82e4392749fd7298d21afabfa44ad1b6d5e492cfb9f1e662dd71e63d9c89b861b238b89e16ed3e48f8495b52f7b7810d05a0701b9dbc8d59f6f8bec5cee478252598a8ad26762c20c448b1968a6aa403781aefbe54137ff5a0d1e0b05d4874a5feb6b0e33c49b4cf36c1bb40000000b8c424492af47c11323d009240dc5e05c1fed27d68ed5137ee8173695af92ffdaa83dd25807e2d8b8106e762e7fc16a4ad34b44957ef885a7b07632d4d3a867a	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429744436"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000485d5bf3879a1567fc8f4a1184a66b756f8567b63dee364bf6ae6530f2785d97000000000e80000000020000200000001cc5fa43f924b352e4031becb7a1a102a8bb4cc2ee7ba55be23f8f7da17101712000000097c6673ea10b5f51312e4e1a768b1ffaeb8e145e4b4a7fb8650eae4a42d0daf5400000000e43d45548a3ee88294f05af41adac0e6e1451b231cc05297b4d77d708031282dd6049193fd8f66d0450cecc9921ac5c2024dc64eb52ca5b17b4a4507f35a517	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40de9a4ac3edda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3024	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3024	iexplore.exe
3024	iexplore.exe
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE
2236	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2236	3024	iexplore.exe	30
PID 3024 wrote to memory of 2236	3024	iexplore.exe	30
PID 3024 wrote to memory of 2236	3024	iexplore.exe	30
PID 3024 wrote to memory of 2236	3024	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\94b35a7ae1c06ee68dfe940347fb2da0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3024 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e06e52a12eb129255e447e9cb51c0717

SHA1
553146bb37811a5b9c362af1ef3e277cc7aacefb

SHA256
6600dce697fee91e6104cca15c5793d8322741745d052e3a0d06f577c281f026

SHA512
37367a99e2e358fd9a5d5bccf98d66f3014196e2c1d3fb8755c4d7819295a1fafa3d33b7f09f32dd5680a95fdc2057ed19c2816fae1890daf81fa4297f9f3eb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d8894aa51e61305f59714908e5a7101

SHA1
0d01087221f503a219eec5839355c0946f8e7343

SHA256
cca2a3b395772037dcae09984423c61b67a6b437c1b3db3a87d88232339e38b2

SHA512
d8d50cb0420afc7bc28ddb36d6befd5bffd6404b7ee7baba6c0c2bc8164bc929f92c41736d111c8e515f6c9ceccc8909015e924234e4852f9b6960beda09d466

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52f7607daea075e8439d78d36ba51be3

SHA1
822f7bbe0e63081ff75b2407d63b8407f28e7c23

SHA256
a486d7b45dd87727547077c36cb879cb90f6b52cbea28f97f2fb62c01cc2c418

SHA512
4a03fd8f1a8c68ee1ef8f45f11ee38bc0d3accd9ee535c85d06f4e4b5d04fc4bca1e358f00e1da1b0ea49f04b751a4a28e6fc9c1a81ad97f93be3468c4d4f828

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cdf747289b920e72c12013521fca3b81

SHA1
3c269b19fd59c89215d45153058f4352e561b9b0

SHA256
32eb78fff9c6c9a3134d31a664a1b7969103992af01690e2f9c57d8abdfb55a5

SHA512
95ec9a61d5836014edbef2d92f9dd4aa16a5972b31021be5ad33d0c50d2c27bcf0c3a958648b9ef476777e6ef299f27292baae45d113ab1d0f00e521a04e333e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c8eda479e6582a9442ba1b1ead7a3d2

SHA1
dfa1c9633f5b5da95d816fe8ca064b9b8d39a046

SHA256
09b3aac66e4324815715127572b7ac9c0b5d62ab0d17c66780e4366ec6959b9a

SHA512
8dcecddc54d506ca755f1b592ebf313a3efcabea9be9e2d0aad5480b520bda4d603f2f2a614cf56b915c011917123e970f95ae176547f59597c5e940d0c0995c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2776fa63965a04cf53ddb4f85cc6109

SHA1
fc6cd653d567d608e0f4fed1d1c5b87d97e33d6d

SHA256
3d11c2ebbec60bb81976cb5ca4c292b0b3282347935598939725597b4830c101

SHA512
9d0b190b1182804894e151513ed4d78532da732d42305f953355715b78674fc75470912551284ee7eeb5b71746947ac88f37f6c5760cd7da388e8a72bf0f2d31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74bfcdea42d613e376d42ca3e900c1eb

SHA1
f184a8d1840430b5cc353855e63c58c28dc2b370

SHA256
b4694d3e396e0a2de63d51251f1ed7a1f7e1c4b46edf3aada85c5911eae237a1

SHA512
08bfe0c576d305d1b88120212aca43b3ffda27dbc189766f9acdb3cf36c10a7d61afd2dc7714448cc233eabc2f4467b1f516aaa7dfc3f36edd07cd8ff8df6f22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f3718d3c90075b3f9de2b361dc335c36

SHA1
996138619653b74fc8cce6d61e48a5e01e47aa7d

SHA256
aacd5ea83ec61183b86a7dfbfd36a0c209b2092830f5d2aac608e6e01b4bf09a

SHA512
0ae1f90d9f1f03e5a572258214c1e014382feab96bd271c56a9b75f7a7f247ff80eac83b5e45dffc9162e716523befde4c49828a9cad92ce81899e8ec0e7098d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f47e8c47b588e433f4e011dcfbbdfe71

SHA1
b18e13798d73b6cced12142788c0cbbee7abd99a

SHA256
06872f1fbc4f75371138ceb2a461360480a50b881f3923048efa7b04e500d9fb

SHA512
139d49b14f09325c82227b4911f83490afa111c82def0e8c2f27c484e6a7516fef960dbf18e5599bd159c4e8f6e7c85690039f983b8366ef140b10cb09c15814

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB2ED.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB3EA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit