1662ef7f0137410d1cf28520cbc601a20d8003ac4dd0f22090fcec5a24f9d557

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22-08-2024 21:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b9496cab68bffb41fd3dee21090e1942_JaffaCakes118.html
Size

2KB
MD5

b9496cab68bffb41fd3dee21090e1942
SHA1

39bcb907a1c591bce6c675bdd6056af6ae7baed3
SHA256

1662ef7f0137410d1cf28520cbc601a20d8003ac4dd0f22090fcec5a24f9d557
SHA512

004bb6e2822f4728f93be5892229a2eb4f5cfa3307a52d024495526dd4d106c6b920610df52dd6f0086a2e5726b7ff244cea007a0cffe3cc15493002b18cc690

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00c3f145def4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000e04e16fb4d3afb7b71bd14f9124844b213e4378924cb6e57ac60fa7cc0917c0f000000000e8000000002000020000000fed7f2613a6599bf7fb779784a8b517837f53699ebf40e2abe2a834df1bcd96e900000003eb7a068ac6134a645547de55942e7028f1d05c5680cc14a53d70077bbedb8986c2e80089d3f4a88e6d05889caefd45ddac0387332630cee4b3798ba8fe88dd4a9cf150fa7df15ff2f31e5c21fbf05964627039ef5515b097e84efbb36803fcdfb7ce4e0f6dcb03d2beae90cbf195fbc595c6aa85355d0db1afce33728e79370ade5511c1d828ed276b90983404ace4a40000000f5b2a736bb4ae01fe53c178e489d19b6db61484c0e7c5f45e6a037a7350c7d4dff5dc907fb3054a8656dbe8c2fcf2bb444d2dbf42459958151cb4540356185b3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6EAE2A91-60D1-11EF-B7ED-52723B22090D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430525720"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f0000000002000000000010660000000100002000000070dbae133b224de187e0a0a52b6ecacc039acec573dececf89cd3e3680c1da8f000000000e8000000002000020000000fe8edcb55b5ed86cd56b4638d46774fa5280090b362a6c003c4c06081df447ac20000000a28af72dafd241428f718af2735932c7b262b0b76ed1a1c7b4bc45b5d0c47125400000008d59ec6c6a1b99e91d80c9cb4d84863c375da6d123234b8e90c98f6b8c06b3a373ce3597fcabf05c8f2ab2e637f7ff678b3b419dc95be6a98f43391f10912021	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2704	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2704	iexplore.exe
2704	iexplore.exe
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 2720	2704	iexplore.exe	31
PID 2704 wrote to memory of 2720	2704	iexplore.exe	31
PID 2704 wrote to memory of 2720	2704	iexplore.exe	31
PID 2704 wrote to memory of 2720	2704	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b9496cab68bffb41fd3dee21090e1942_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2704 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4f0b55c4a5a976bb4a9d8b59d3d7933

SHA1
b90f041995b8a3e29cd72af026a34bfce598276e

SHA256
1546a457b5033359047c1fcc22242cb1635a72475f9fa6b5add9a165062cbc42

SHA512
508707444661fff44df08b21b5d76970df284841175335697280c6d47d0207bdc7afdc878bd487acd54f238a509265d906c37cf1a9e23857ade473939c4219ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1b453a58fe49118dd3ddcaa52c202566

SHA1
eaff0ec3ecb2e05372c112a89c5a69b541d17a89

SHA256
4a44f342795d8f63ccb097857d7bdde1a5aeb50e6bf1e3ef841c6f6a1429feb7

SHA512
7d18e4391af4caacf6df4b7bfd920e4cdf9e5e7547b829278c6081ef105133c38d13f83614755a855106dd146e5105ee5d04ab7b00e1655281ec9cff25c85cd8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c5b55092db09205442573a9cd63166b

SHA1
bb7fd56dd97c3fdaca0cdea85a0f1ed98949f2b6

SHA256
94f8c0ce6fd09c6b5e027658bcfe977f529a824401fe2b1060a12cf1fc588747

SHA512
7b2cdafde20b5e62bbb15c00537749b8fe91d3715042b02cb75996b2cf9af2edffaa88a16369a6e076d8fc838745e1b7487980d95c035ede377cde845b04ab88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce60c9efc717e33416edb275199a1c89

SHA1
794e96d2ce29cd8147a9717e3f41d209b5273c78

SHA256
4c251c27b7afe8d97959fdd614f43183afcf806833f0f7b50617677a6d257747

SHA512
8e3b67e7f1d9c22c64d929f15731f1998188fbcdb6ff80fb18a5432f2ac442de639054bcda873589cc3505768fad9f16b7625837d6a2b7f9068267d549f603bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8daadf3dc6dbd2cea0af4a00da3bd213

SHA1
1b69605d73f1d0bda603c2a0592d54e72fec508f

SHA256
08cb8d652caa7c470dee2a29573a9a5277962e44d7536f3eba668f7fbb876a1f

SHA512
42a6faac568af7f24e3f6414aaca8d9a4ab563851077fe837f9f94accf6958eee9e854d13cc017491c3e886a3750572316ab30f4f55f150d43e702af648bbb5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64dd528e0e8d60ec36612f8ea7e4c268

SHA1
6cbd77279ad47b06f3c4ca0b2f5ed87456e9bcf9

SHA256
9f099c7681749919f76bdeb9c88ebf4583d16c736bbbe896d7ed04f0aa93e0a2

SHA512
4b98ed1ca0870f18cecf9cfe3e2b7b3d9d9117dc5f28cb57ce78690f44f59fd363871715b9ebabdadd3d2b0da1f8640d1cb66b4c9f481224ebc5cfe9268e1b78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c059fccb28de7c17012ebd4fe92ff9f4

SHA1
5134c09a8502f0ce6f350cd8902052df2573efb2

SHA256
bd3894b572ecacdf37039f725e75356de9769878933074a071a0e49cfed4715a

SHA512
57c25874b146fd7c6b1ee4e86f026a84a01b4400d8cf7a836211d30136d40c3b9abf3c50dce40f377d744d822f49ef0c18e625865901500ac65b7c7167cb8a23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
156102e1c6060f3d3ea3f682ce10d110

SHA1
79251215c998d734ead0687e1c9e6ec433750036

SHA256
7a4f91b065f1ba0b6e167a463bc951d19f3042b388192333caaca36a9c0a30b1

SHA512
c024c13349f85b92784766fedb605365e7da43bff5fc71077b77c25e303473fc260fb8c6a0039a2fcc4ea44e9d80ef61a49c8020a546def7e4bb9a7167674529

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d848bbf5cd7e0ba38b9125435501d7ea

SHA1
45af63ce83bca24a5022b97896f28623040da03c

SHA256
2b2a420e3c3a68fb6787cac02309d32eb6aa75c061c5a8d23afaddf7a8f26f11

SHA512
19d732064922a7dfcc8df3362f49137823626f71ffca0fc44bc80ca4d242b562f023a912cd4eb9c488b484d2c1b0b7ab9db404a2e93187e14b957ed92572356c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1113.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar11C2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit