49241e5789a6272374b8edbe21349773e9b8c5725674bf0fc236111a55e71a77

Analysis

max time kernel
91s
max time network
93s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
28-08-2024 19:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c782f67be99686b8ab5de314d4a693bd_JaffaCakes118.html
Size

2KB
MD5

c782f67be99686b8ab5de314d4a693bd
SHA1

e56db7668a29a544a4ab6e51f73e1d83f559663f
SHA256

49241e5789a6272374b8edbe21349773e9b8c5725674bf0fc236111a55e71a77
SHA512

7b37a466d20480c8c38902d9352bd23147993783380d38c732069e99c494d47b4a9af467b17b460004a3cbd60640be9fe1b1be0c2c298fd835e5de9311896b10

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{642BEA11-6574-11EF-A839-E6BAD4272658} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000029d07c9a94678e32a39844a7e4780e606ce4777d3eae36e556b27b6cd092df8e000000000e8000000002000020000000a46b9f41ab8fe6b6ef23e91b6feaa2d5ffe988075e122e9de9e685d52248e59c900000008fb478fa7a7a9c0b5d9b440a2db5c70a5785d00f43ef5fbb930773e254849cb0aea628b9b0d3c561b706e4cc4655b56c38fe93c906326acbcca762ea787755a26351536937674e2b073ffa114dae21ef53c66680246abc1f0eb72305bc8c208ec73405a0d53e1fda3e899fe0b274df0e12cdb101c77276b301bed946f1afe16e2be10e8220541859ae6df9132006a0ee400000007d8ca3d3562bc639b52e699bbb758c2b45f5f1a7cbbfba5f76069109e4a0be39539ab3f25ace5728e1464aa380386f78c3cb6d680d2cb9c147db0c7ea2a1ac77	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 803fa13881f9da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431035496"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000d971018e080b5a883e74e8bd2a33316437525e7a304d55bf50902e912f18cfc5000000000e800000000200002000000041e8a96fb69ad27f1b427e806de7ff8aec54d1807f9edd32192dfa6a4f34d5be2000000058d7895c7a38b83491909154306ea974697fab5b73dd2c9d25bf4d5515dc629340000000b377edf4544ddf0c094485fbc03f989cd175f6b78b1c83ec1f38b80ef3d761079b812d7af13f8a78e5fb24233b844f311cf7c3416f380f10c3a1c5e32457300c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3060	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3060	iexplore.exe
3060	iexplore.exe
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2448	3060	iexplore.exe	30
PID 3060 wrote to memory of 2448	3060	iexplore.exe	30
PID 3060 wrote to memory of 2448	3060	iexplore.exe	30
PID 3060 wrote to memory of 2448	3060	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c782f67be99686b8ab5de314d4a693bd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3060 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bdae8325e0bb9ecc1e41341d62e75de5

SHA1
8de224558d5d7f90afe5896ddfd3a9beaa15a305

SHA256
0ab7c0b818a026e869a5d2357b540e981d2b0782968ee0171040812883708395

SHA512
206836418ab70407a1efea3b30fc618f3205f67a2f14a09e6c317f379312071cb4820edb276bcd94cfb49e4ad0a5867485976123cbbeb91bbe057499e7731854

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ee2f5935a33a98ddfcf4d51444631672

SHA1
03d831b9f50cef19cd6768d44efffcc60ccb0ff9

SHA256
c6912b8c1749859975116edf9150ef85370f37c394c20e90262083b8bfef6855

SHA512
4af181c9230b0107dd1d321cd4e8aba5fcb46fcb4f7767814b14791abe34a07fab9c897774ecf6ee1c5627490e58c2d0ec8c81dbcfd79be155b64ab36a7fd0b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ec1b8fddb979217f092485a493ea693

SHA1
3a6e63a9388d37ebb2efa2c51d1527852c1731ea

SHA256
1f302142db71db264bda1fe215c88f13326fe782544761ddc29e3312cf4b3ed0

SHA512
fc28a359155e37c22b6960e53c7c964f48b117ca51996e70d99f3f6acef8a7188b12d9ca37755d685f0a056396d3fef00792fe3ecdd8deb2b909af3f53a6cf03

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
58a1e2065a162d54521d02f52d971a7f

SHA1
1ed2f392b92caa2cc8fdfb741c652da724dc592b

SHA256
11e131b79e350dd5e09f27c18bf22ba2516b9528060d0acf54d57614edfdfa22

SHA512
88718fa3dd22f8f53ca477a3c011ed80da425dd99446ecf84287f2f3e71a07b7e28844b2063707de3dfa6a8b52c1afcba54d3a595382ed211d9b7b281c2e7261

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0327625e7452ce7e4f865a701a1c7371

SHA1
0947504e0a24be0af720f74f7f8958bb038df79f

SHA256
c2cb740df24c756c9719737854e5518d2e1c2ca9b019c6e1c6bed1b89c230907

SHA512
3db85563cbcc50e7e828ab065a093a8bab48af50cf2793170fb541030e43d1b99450b67c031ea17f929d94b5c745028c896315fd198b31b6c276c6ea2e9017cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b5ac36c5ab513c66b4255ef1a977d35

SHA1
da7db913aee1d6d8ff1312104755d8c7aba6cabe

SHA256
5a0a91e447f9d0bcca53c9e6d9a83501874c580391a8bcfb82bea3bd4cfaaf94

SHA512
d5604b7e3a67f23e87e7fe0be3a6fe5c7d6b9e3568df695593a7433f1030145655bf95046a426339acbeb3465690fc3328edfa179c975996896d1c2516877733

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ecdfcedbeda516eec2be3d78fe422fb3

SHA1
1f393013fae1566bcb92debcde0f8a1b50dd2fe7

SHA256
db12740f432b19be19478b484642af001ba089e8af70aa74b70cbf9e76980cf2

SHA512
71fd8372bd10594f2daf2e551c899534427fc276f54ad1c2f72035913da9a641d22d214a9658f6f4acd42fce29bb0788bc6bb041d48efec726b9febc0bef1ef9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a932104c2d585a6a8c51a1e31af6b746

SHA1
ebc952975c22ba9866a76df07908bd772465fd7a

SHA256
c61f113ecda19408957f3811d16e9e194b84ad9ccf6a59c5636f0c7215a7cd76

SHA512
1c151fefd779f0a64b038f3f63c6b8371080831d4ec926da169f8f4ab1be14bafb2ea4cbb492c2f103283f55d3f74efecc98cbb5204d40b1612e042bdc391ec2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d27de5ea0b01f69a560b1b197442d14

SHA1
f0be876a81c055184b6cf3f7bbd0d74138920182

SHA256
adb1368e2dbca89d0d58cd3e4db374a9c53ebc19d649402096ef94498df5b277

SHA512
459ee4e86a98eb925bc39fbb35ae2d5a3b17cbd57a3562e6414877fd46a08dab4524980867ff38f77101e86d5224f7926a51ec040d189e7dcba8ca21a53b2eb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30a6e3f97574ca37dc9813ee552d6a0b

SHA1
6be1ebe05eabf117d0c75209d8678ae2d3f0bf63

SHA256
0a64e5dfb9921be9803b571dba9af5c1f520478ab0b158e235f37f44a653b951

SHA512
4a2d0a0b70dd37e1d12dd1a4a6adb291dea6af6d3b17c741990d528d5fe912ba62414589799f27518fd32e7fdc8c0f2c3ca0f6599a62cdea876a7e968709c8d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
807aa8c25453c08bacb010bb126928d2

SHA1
61c43e69206238071faad87292f5a4802d675fef

SHA256
13779cbb602ae5e7a2a0d68bfff547ed51ff22c9fd6126b51253997d8dab0b3f

SHA512
6642a14ac96a2566063f964dfed80dd747dae3821555a0947ec4501a16a9cd79f0cc264f5eda1476d57c8af0bb409e44b5a6fd47ee848d65fd89ee02eb558b56

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCA16.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCA28.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit