7a694dbb8382ccf6ef10c7c094dc737b0420dd5afab1c96822713a71646b39ef

Analysis

max time kernel
121s
max time network
135s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
06-09-2024 20:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d05e210cf350dc01e23431d162228a12_JaffaCakes118.html
Size

3KB
MD5

d05e210cf350dc01e23431d162228a12
SHA1

a228ca582c7a2edc0ee87c774ffa879b9b5fade8
SHA256

7a694dbb8382ccf6ef10c7c094dc737b0420dd5afab1c96822713a71646b39ef
SHA512

999cb5765126aafe687302c4b955e5028c877fc28af3395ff5e831a3d19b0a1ddc7ebd987b1648f59a363f8bb9ce745b9d7daebb4a0be6d3278dfede69a9e860

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0C7CEE31-6C8C-11EF-8BEB-4E219E925542} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4001cae29800db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000a05a3fafffbd9c62546a9e0cbea4be1c1804e8ce2e27c2e9e5d6ac0bd690296c000000000e80000000020000200000009b382a718b6a36badd2d47a7d8f7ada5c8022084115f5d1a3b558dfd6a70f34a9000000061ba55f7e82522e05b8dbcde2674b40f3aefb1c3a446a53c0c7f6d936ce8baf795c5a1a4749433011dad5a7937e82dd648dc51ac50ad947230625090fe3331fd17452a2b3f62aeed0bb1e6e5b018d79bb506e8d4e8fc213268d6b0d51a221436c02b907414e0ae7e686592a29ac333e6ea1fad0a914e5550962de8e3effcc6260e12e100bb5286c2c68689d66b480e29400000005d186bd56095b2550601ea1d4987003cba24150060ff2c373f16678a45c5b524818869dc87d9a62f496bfd01112a3ae6f3f75e1c9052bd88ec70e55cc56149a1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431815298"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000a7e775e7db689b385dfd01cde01a9483e3b73bb58a091c85ab48d6e249f7e2e9000000000e80000000020000200000008c14acf3a643ef4c87e1a308a30894040c8698b338d38c2d06a27ba0a064805220000000cf0c2420d0592333d06cd3fe0b8de168500aa464b7564ee20367d3c98ff4ea214000000007c0cf2c6a21e06d73f124986aac021058e96c5281d27c576e4a745270c26aca94062065913e2997a28566b0f6d60617be44fa5afe0d6ccb58e89bf95dba54c9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2252	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2252	iexplore.exe
2252	iexplore.exe
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE
2084	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2084	2252	iexplore.exe	30
PID 2252 wrote to memory of 2084	2252	iexplore.exe	30
PID 2252 wrote to memory of 2084	2252	iexplore.exe	30
PID 2252 wrote to memory of 2084	2252	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d05e210cf350dc01e23431d162228a12_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2252 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae5041d7b6edeefb50e31f63ccaad815

SHA1
816b2992cb860cbf523646c4549ae681d283e3b3

SHA256
751ebbbbf9c3a4d0932c9b98e5382a4b762d4fa9f1223ab82c350200d8ce8307

SHA512
30f7a5e3bc82908ac00bf5cb5375ff67f3bb123d4e1bf95c68fc577cd014adde79363f494afaea0dc56bb6fd65ef02c467da4da94a4bab374ca1a9fc366abc99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8063cf27ab42807279c5e4d0ec8988f

SHA1
805fe17bf75f0b33e3665ef9389dc48548a3121b

SHA256
de069cac5c0a07be73bfcde697f3f02427ab44e7f3d53827c813cae199f3dbab

SHA512
dd15318ae87fb4199a9fde1667835b4f66b84532c15d08407796ea70791917d3ddbfd0407b066dcefc45fd2ecd8f8d15f1c6742d248c7845afc6f2f9780b1a5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0c15a86d2209d8e002d4a1cc98d3f8a

SHA1
14b627a4ddcbae7cba6980d05cadf2ea89e384ba

SHA256
9ebf5c9991bfb5ba2c1f7f7f72ef1259c9375875c75bde18fa1e3f1cf276d789

SHA512
00f602533cb773ce1f1e5f9656001b654e2da3ae242eaa6aa997c9e50eba4d242ae45fc9b832c612dcff44a4f4c83d9ea9f861f03885a6ba7b154320cfe664ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4970bbb292aa8102d9fc2810254d2d14

SHA1
31d08d55bcef5e33158fdc938cce0d616ccc4239

SHA256
b4cd6c58fa9cbcc98d5160bc4ec4a5f610ee8d0c49e6b7c0236b77d831c820a0

SHA512
16142e00434d64a557a02ccde2029812c15a90f8a72224cffd79d9a640ca4759cdd042d5b058f1b2d5b58e3459baf598656b8932f062877140114a766d4af47d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b4903960b99a013e5c76abc9534fa98

SHA1
0de0b5fcfe073fbc05cdc3229c2abab0a73a725f

SHA256
781fb65024b9300869824655b7e09cc4537310bba829e49bccec0135c24f00ae

SHA512
f13bbe5928d1d86a6a1fded4dab4c68e26a425260548c15d6786ee2c5c99424f329ec1c76fc94901e72d99d777f2f5d622fba2abf81189c955a4a76695e840ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8f3eb877fd44e78ece1a6d20157fb5f

SHA1
e81ed62463a035dff93718bd61e0eda4553eb116

SHA256
ea607ee26086747487c01053b84cf127df71ebfdc2591057f90d8b92cf4caf3a

SHA512
d3b4c408407f30a627d711b8e79377406f87245b61f157d79998c29eef5dca2e7b8a41505f562eceb00c7098e4d08a761c90fac6ee95ff43269f9e4026c9a4b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4c48609a03f9b9abfb1a15fce87c9ac

SHA1
e5acb2981c54cbf86a9996d7e998f9c2b0ac3d11

SHA256
85accecafa16715884d5a9af1e49630c2d6b80556b88219218d042e4e660f298

SHA512
5e2bbe9f75a18cf044310ebf62a45bc11b31fe0d8dd474a49c0e39ad6246ba4df55386dc0bd5dd77d4820c72d957f3fe8b29f9bdb66060e40bc9189ac636b52a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e43aaf01d177c0453a888e52afde224

SHA1
3b40e28f35055e790fffeb1c45857fd8d59a5562

SHA256
9886f465d85663f3e732533fc13a3c55750296f84dccb2e1f7a536f5b4c6243a

SHA512
6a11741ba9df18c2b45cf3a07175b1b553e43b46b2dbf6933f1d2bcfc701f203f6fc837bff224876d45fe88fa4e341f41293a9fd84d009581f46a6859e5774f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e426f71c38570dd4d8a049d00eea83dd

SHA1
7dcda7cf389d94bedda94fece7653f03dedda8aa

SHA256
01a089d938c92a5d86d47d475cfd6cf9c868ca1888e5b6936419ea64aab457a7

SHA512
e7cc8b9fcfe14c7aa699284cdcafd78b861ebcd9d7c22cc77c4fe9588b3c9bf1aa7c0be07f91639b242303c5fa29c0302076b6f229126a61a1441df3ed04e5fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
02c1784765144865e6a01ec24adeac42

SHA1
35bb7f9e08ca9cedec883c4476ed4055fa7dc619

SHA256
825d91a4f0dbe4ee8c122d23d86ab18f25e85be7e6120a217b3170c043289450

SHA512
6a56e2d15dade1776007ed6b2613edc800b91507b28966a03df81453f8b85f93210da8fcb004ab85a75651ceecc69598a825e922587986a026b47e3ce190ec78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e93f4b5a105b3df7d65c157f0605cd9

SHA1
b2a5f11f95d0b5f9096aa56b25e12d5080c6059c

SHA256
037a5ccb55cf8b90b79cb59ae74ba94731c698f6efe8cbca0bf42ababf664492

SHA512
8fad0bd76668f9c49d82647da9545d3d4127dd6692270cc0de54f6b3e81fdce1aececaca7adb3493e17ccb3cd1aed033cb146681856b92abee28143d9785fa74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc20a37983925a4a54b6c3ce17b7b4a8

SHA1
5749a4aa84853dbe486e8b779fffda11be651eb7

SHA256
a133e32d8460e6a148de950e8ad3fb0963113bc65e788688abe00e262affab38

SHA512
f788521a05e5f613a4a493da617d75f60beaef45e3f707fa70dccc0ba1407ca5dcb29618ee17062682480da42398f1d5ee040c16f791bacd1d02ae9eb99d9a58

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7162712616d1844cbf6f5404548813ef

SHA1
b76fc9d9e0bdcf13a1d7e988ad4796d1bff7699a

SHA256
4aba3036eb72e43ddc84e87db6bb1a40c1fe38bfe3fc00bffc7dc1cb909c632e

SHA512
c97d89b376fe2d25d71f9e1b39b77d08a05739ce7261bf33318db50be58853d6d2f24732a033d1044063eddaf9e8d8ecd0c3e454c44ac90464489065b506a496

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
18dd2da869eafa298fc94246d4082865

SHA1
c5056cdbbf990cab089ca0b84ceb132395f93abf

SHA256
08ff2ab4f07311d266652a8d5fefa71db69564c35f9c406f5facdde05a075f51

SHA512
17249d634c58026d7750ed01db3e03a85104a70b3511e046b5961f67fa0c6e008882cab31d09d567e31fcf53af16a66293ab697b5bcb6650742ae91c7dc7bfc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e92cefb88b5cf502094218376a746fc

SHA1
b0a9fbd17fd96cd5ffccf31f86449e9b9834ca7d

SHA256
4abca2cb6bcede452d202867a8be8e6d90e9bea5e1238a89f8a68dc8e9ee3f7a

SHA512
c47a043fd9b998dc541736e748a9920334bb68a544c9abb09204e6511168119172ba2f3d9189ded857a407e9f18291d39228c2ab2c5f7f4be5199f195b295fa3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF900.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF991.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit