da0d5ada66107f8e93c740d750100d7989892daa06f9bb853d1a73923f862c69

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
29-08-2024 14:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c906199673cedd682cb898d5fa158d9c_JaffaCakes118.html
Size

818B
MD5

c906199673cedd682cb898d5fa158d9c
SHA1

e49e2eb7a95fe61ef546f8ed3339659c632367a5
SHA256

da0d5ada66107f8e93c740d750100d7989892daa06f9bb853d1a73923f862c69
SHA512

f785ee4ed750c1f0cb9d98ef11a7b61e9e26c77553ea637ed9caa90d7165d0a8a11676ee85c3ffcc6fe31cfebedc3f6d4fa301ab0a8b6e9e049f055a1a372663

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 105f356d21fada01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A9AC2141-6614-11EF-98A3-428A07572FD0} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb9000000000200000000001066000000010000200000003ff8f9a398658ac692a97e39ab10c2ff1553e3b9ad4c71f1e7fa360b29f09b4b000000000e80000000020000200000000e145109270cdf19974fbdfe57731043829d8f236c8ebee8469f9849b1a27d75200000001b584cf8fe35401afe83fae835334eeb6a2c89d68f621ff84bf8a3af1468df244000000078777385d932fc9aa4b2463ea8da1cebb0656a8b07c319d84fcac0675deca39ba507c42df75dc7bdc8ea428fa57c58de7892e04a2eb30c92f0024048d5f9b1f9	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000b6f889ff3c3b4608f9bdd07891217530257bbb4070500b15ad133fd6e6017c16000000000e8000000002000020000000142a82764ce77aa36f8a41b0494adbd9c6f61b308eb197b48a45d541be5dbcfb900000003b823573e56912742e5829e988f57a245ef6afeff5bcf0f763f4cf3a4a385aadcd6c7b4f685504f20464cc85024d2d9fb25f7e086941cdf925246ed456ed437a506c5f93793e4e0f0c7cd63e3023806207524d31761ada6a42711b2d3c7f34efc677bfd2f306f494e7873f4a02a8cc51bfe2cd9295bc63f337deb203a07346082924a5e8bbee24454b3d8b2e72e3caaf40000000a136549b094ea1271e658acbfc35172bd5a3f92b30630a14de4b563a3aaf492b3ef5edaab55da3b6dccbac9c28db22668b6cabc6863622a969f536847acb83ba	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431104309"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1164	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1164	iexplore.exe
1164	iexplore.exe
812	IEXPLORE.EXE
812	IEXPLORE.EXE
812	IEXPLORE.EXE
812	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 812	1164	iexplore.exe	29
PID 1164 wrote to memory of 812	1164	iexplore.exe	29
PID 1164 wrote to memory of 812	1164	iexplore.exe	29
PID 1164 wrote to memory of 812	1164	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\c906199673cedd682cb898d5fa158d9c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1164 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d23c1fde02a1a85cfb3a91366fc7d979

SHA1
29578d371a8d3489c9a3fb9b0bdce811b6bdf546

SHA256
aa85140af2af70bf4f4a6982997970cb83a6de0cd353258938c1e1f6ed3d2cad

SHA512
36732c300d56f02125615e85bc6cc69f57c2ef62b4c26807b20fb99ae035a056c699d8588a52bc9a03aeec33acc1495f03d01ffc4f9afeb87043cef4b1ba7cba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4c8bf1702699f28079ad64eb7470c15

SHA1
e720d07559c54d457ffe63c95b98e74407a5a6ef

SHA256
b20f16f17026917dd2186d84667486f90662beac1b54dd316ec4a42f45420a4a

SHA512
8664cb8144e6194e1df514bc5bdbc28edb2d238395c5855c774c60c70ffe9e8b8b91549342b0bc1a41da4a57eb4a36f13e6be2c9e23cde815f7adf61069c851f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5437c02a56a8d31887c48a9fdb0076e

SHA1
ecb247ad169b0d4a9e9d28a6a15fa2ca0f90293a

SHA256
ac88350b2b8c72f793cb0d6835d7093fccbb46319a1adf19377e4e4f9990482a

SHA512
ba576f1c460d064836f12d480b8cdb7231e4e1bb6fdb32fb94db40a6a75eb573fb798c72c658c72a39e05c58242bf97f5ec274b1332d8a59ca57e69ca137f330

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ee11c04e80f0159fa6f7ae7eb8c6c3c

SHA1
e464902dc01c0ca7e5585e234e1f321a52224728

SHA256
883d121ad5c11c3885a0adebf084da03f4c1a0fd10d46f7b7bf330c2d6cc87f1

SHA512
a0e8f3fdb489db9ecc819716750615b20c05b44a8d1dac709221a5eaf888ad8c863d9041acc47acb2f6a45ad9a4942a2de27822a95d3a3adb4f955a3ec59ba59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8ffc98349800b57be60a6b5b4ff4896

SHA1
c7b5adb23097460af542ceac63ce2c5aa59c69d6

SHA256
1762e5b87270afc17a767d521d9b6bdd761582303fc4f342bc3d4598135bcb7f

SHA512
f120029fba62893678cd454c459a1cd92799693cd77178474e7a819f044a8c39fac2128cf483423135e9f8a32429ff909d772eb39a94c36304b94fd28233c96c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45c0325502fe4a04ad093f0d79500603

SHA1
c34c1a7e7f8cee0dd758d4b9fab2f862bbb9ce76

SHA256
b2e58a3ed3ddc9cdfe5d812da5553acb5efdb6d7108f408fbbbdd1a413910364

SHA512
878721725ce0b20bc61aa4509842e5cc16be08e274adf085438553041d9e17ec365b2571c6450b5c1031da2f5ac16e7adb68d7a36c481ac15bb5c5cfe32551ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
024f376470a768a2ce09e6b572973df1

SHA1
cc9dab9d4d3fba1946156ca23f07407ab430797c

SHA256
7fea4ca854b58c4b9022c508b7638462cbf9bc3a8aa34ccdb0755c563aa67c41

SHA512
162e52403732d66cf6466b64bce346c1412c9f919282c49b30e9ee1f752aefbb9fa71d898a8025e2fbc63b52cbab70a2fdb3e88a9d58936b2ca64154c2312c1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ffb3976bad91468e42c356a0fed02760

SHA1
f81eff4db41555d7f8095aff8fc3c171c42c9357

SHA256
24e59cef60b03f1d73453b5f800e533a42db69a93b78b55fa9fcc5b1a0674d6e

SHA512
695a90fd6e73b7009967a186ada26bea0e2548f2e6af36408d83504df4c1cd3159c1929e0c6947a86febf66ad68d84d61949f9292b45b76a8d73f6035da081c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b19aa0aeb6964ec5018e8299fc167e5

SHA1
2c4f501cf33f6c5f3858de6ff21a9b6f224f664d

SHA256
c6f2bd9d3e0d73024d243cecceb4b9d824ac4c5b35fb011c9660fb0012de6366

SHA512
695c3b82e80c20367fff4e9503795361742d11ea46100dbea4e17e542c1fe9c163e0a055c7a3aa4d7c0850e71790a9efb4beb58eb4d4fd34a40ed73f2a9ece75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b901a4f74d1638be86b656a3a09a365f

SHA1
f7dd10165b09abfc524dfe1e1973fe782bb9521b

SHA256
c60610e0dddff8245fac8653c2725e06c5095c3b183d9d1e96bbd8954ba73fd3

SHA512
cc8020fc8e8b8321611c62ba3a7049c5e9e191ffd033721b5c86dc1a7aa2b22aca07ef05140a611cda7ca5c5406d40139d58536ed27af68f964a666f4b355521

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a131029f7c51001a243dbc8aa46f3f72

SHA1
4abe654a4bf214438450e32aabbea164f6d3d78e

SHA256
cd02431efa72b0ff5c811523071cf43f54bdafc7c95c582d223615c503b1bc34

SHA512
cb0b02e322a644e5099b29697fc9e059d49e7aaebcdf1098444136fb2cfa8a7e4685d884b231b86c2469785b3fe37abeb1655f97e312117260459c27630c8ce9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f25b82883c35c2ba044c66548cf30fc2

SHA1
96ed0bb9d19c02932ec36583b0972853623d9f90

SHA256
f182e6f4ff84e974310df5fe0dcc138e7a30458058c95ebe5f3cca2d0b60c1b3

SHA512
de7c6a1ea29111731ad5df79e829a883c5e853b292c7b45514ec96c46f9a3e750a499e7cc2f6a65a8600f1e3cab387aa6510a464d9cb3ada1fd9807058a289a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8dbc10d8cf5565716bc45a2160c0aeb

SHA1
5a730e179fc02065df6838beca4412e48623864d

SHA256
25f2c694f2a7d46dd0f0ef3159abc133663dc5de3f8e8ea811805786cb5d18cc

SHA512
0e0a0ff4a8a45aad9d19a0cd0ed3f37772aab02dc29d772daca7b56e449b47b0f73c3ab9cc85e5afc3e68511eb8a25bfb9621e3cc7558e13e2140f1e06003484

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed0f473ec2072f109590a60f80996998

SHA1
492985501987d588c0f0600b74281c82daf9d5c2

SHA256
23b9856b7819639b8f56afa60f9db8bf46ce4a7aae0dd003be754497635135d2

SHA512
d9d7b82ce172549a8fae50e5aba53449a98ac142fb20075d807523a077b0967ceb9b1b8cab0302c012a24aafab3c730e004919003272ac6ef09c83ee41a1c7ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b61c24e5866307ec8fc30819eef90c0

SHA1
2a47dc5fc9f81426872c237db09d5f0031afa525

SHA256
008d9ea0e2565de6ade17bdf8e8893dc046e3ab48ba2d0d492d26f1e8ad68f07

SHA512
9efa08bb9307c1622bdd2d960f94745293873fcea017e45447851301e5d2fa40c93542db837fe60d0b273ea884b4e38e8a42e620a27ce58d924730c202084785

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f974e183842f4017238afbb11536c45

SHA1
71a1063a57488049ce58bb5b3cef7bbfacfe7bb9

SHA256
8881cce4618b9c94199361c7017a37cd070fbb3cb186f5389ff6f8853c5b6987

SHA512
1dc55527d67ba246bd56897f90dede4473d752ecad9bd7f1b396264b6b67486766e27154ab8d20c7962ef60ddc9c2152aa4227d45c15bcc75d0a1735696f37e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8394.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8405.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit