f8c01a5eaf585f8d29de15669237991c49fcd2085b4f399e947f182fda33ed03

Analysis

max time kernel
120s
max time network
135s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-09-2024 10:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d1c36c3a19a62655bc18f630f8dedff8_JaffaCakes118.html
Size

331B
MD5

d1c36c3a19a62655bc18f630f8dedff8
SHA1

254f43c5411d887aef9b3fea989aa15a5b1df162
SHA256

f8c01a5eaf585f8d29de15669237991c49fcd2085b4f399e947f182fda33ed03
SHA512

9a79b57acce6062c986e13fa1709ea4725d03886f83f355766739442a21caa44a8bc89eb862074243e13ee0443eb7ddfc667f1d84e7044039ba1be7f84b01495

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2A49A9A1-6D07-11EF-972C-F245C6AC432F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30acc4fe1301db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431868175"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c400000000020000000000106600000001000020000000a109373a46235411361b8990dd1e0a52ba15259278e6b5ada14ac15d41e1d032000000000e80000000020000200000004929fb1848a3f37635396e13f56d2c3589cfd1bb0761f14008da77f4ba2a3dfb2000000095c2db27685d5eb40b1f05f40ab94622aae2a824b892205233879dd10bba9874400000000480fb00fe11dd6caa08910409585c0e8dbd9f471665dc9819752c7b556972b83fad5d6de3cd91ea5c447b448cd37d4f7f16979c0b6e468907a898d5c231ee97	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c40000000002000000000010660000000100002000000028a4c7750495e0b41dc8682e2ae5ea6a5cc11e9006dfc54d0c888f9dceb85e45000000000e80000000020000200000000b6cac0402940e359e53ceb086d0803034876a7966285258ac06a65eef42e4929000000032adfdeef2b3294412ab59484b9d23e31db68386e349b46b48db49466e0b69ccbe66dd40defc3c9e3587b3ab967fca5e27929de16bce587d66ebc12d0da1b18435eba2e549c3854bb8a254ba773adb597a7181aef58e7362461385ab09ef6e6781ebf94630cb8f100fff48c08b841c7f6f7612d187cd34c1d2004d4e078e1b400fd71b898d5a807ffa2f525dc79e616f40000000859f49116df5829c8afe8951069e66d2a32a08526e463ccef43751709941a39eda352d69e765511b51c9885dfc6ef43bbbbf2d6d949844e4f6f7f4f6dbf5cebf	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3068	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3068	iexplore.exe
3068	iexplore.exe
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 2796	3068	iexplore.exe	30
PID 3068 wrote to memory of 2796	3068	iexplore.exe	30
PID 3068 wrote to memory of 2796	3068	iexplore.exe	30
PID 3068 wrote to memory of 2796	3068	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d1c36c3a19a62655bc18f630f8dedff8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3068 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d74478026a653a7a33f9904e392bf00

SHA1
f90d113398732e9a97a4841ea9d80a8a0c5e6854

SHA256
3ababd10a947a746d94183c841440d4b447cfd66d0b505a52e2dc5aec7a7a50c

SHA512
b9cc358f7bea8e11e8902600ea653a54a16f3f0a377fc1f2eaa9ea83ee8584f2c19b6ce60b9aee21e6a478b7684888416627f278d681ed086abd6ea41803dcf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7f2cc37fdb97566fbd761b91e4c0df05

SHA1
f4d02bd1e194705bf00bff875c4ae6fd614476cb

SHA256
990829dfc12b95a125a09c922b66b956fdbe7c37cfd971bfa55265055a4258f6

SHA512
3ef6bb8989bdcd58475ddb6a917dfad6410f89b7fd80d937c0171a06462be4c5989932f88f6cdeb0e6170d7faf5ce804719b84a031d832a6cdf6ddef213d34cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae3529adef6089519321eacc4daabf19

SHA1
7a02b8037215a968f306cb6a65fa1446205ce9f0

SHA256
340889113d40b3aa8a0eb76f0341e81b8e522a1e24c8110f16260694d18a75c6

SHA512
863a2dfda3856aeba18e543836a67ae1115402b368fe527c9f31482965534c0c00b85f145afd77e0a0bb168f10c5d459e61c88e56862fecdb7c3bb5ed1c3820d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8dc4887fe9e962af5d7d21da71734d5

SHA1
d74195ebecfcbf589b46653b0b570e4292006cb9

SHA256
c9e0ca79df3ae9a65d4a636794dbce39a5acd21ef78ed6ab824b36e564dbd440

SHA512
27a49e8239465235fbd1c5545a4d6ef9768564a5be08d639932b891c67459981c5fa84d67220b0248b33aef95a1af567775b8631c5d573626ebabc506ab462c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fdc483bb87d0b047d86b988745b1fd7c

SHA1
7ba7e4db5d805b56408b6f75ad2fa9339aff9603

SHA256
5e268eadf3a411118b2bcf339b01b516ef0684c944c1301bba3086d27f78533e

SHA512
01ec3b5fa0537543cd695d41e65604ae72db8c58d60b34898e4c06af0cc3f283b0d04b5491cab3de1f297b2ea8f6ebf5e1dbf35079a925a562a0b6f8058bd65c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ae05d319c2b4667d2d8346b0df62e80

SHA1
14c47a260b9a513f6475cb693c16168078ab2ca8

SHA256
748c9f9ad152f52938c1ca1f0c6fc201bdcaa945ec69bcfcdb9730dfc7721e8f

SHA512
3256011cdd7c37576c4e268dffdf588f0416dfb0b19d2690ba0f2d8c2bcdb82f7b027caca0ecad0d32c2520407530390d6cc8fea2f54168dd731810db3505667

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85a4ff97527ac93528ff8d739a77f722

SHA1
cdb1695102492dc90f80a625f7e8d63e06581d02

SHA256
277eddca9b671f2fcea6ead32ee293b9ae8bd430f9da205ca563e3657294a3b5

SHA512
5a75031fc2beb5c537ffe6149f20295bbc327482ed08bf4d426d1eacb58c8c086bd21b58dbdf2db82225494e1f8634d03d1766f87540116294d977631a5b55a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
511dcb0b8ea8fc21dfe308ca5f928636

SHA1
2b5f8782554e583a6c11a037a3e9dcf023415979

SHA256
723b7d2e415d96da468dd7e1ca1fab2c1994786819ea2af8e92bf072e61e613a

SHA512
162f664b749be51d7513867a7723a5580730b4f523f6755f37e24170b8e0ffe2a0770e1db58ada9598eea0aa98a9e4fffe66f646b794f17568a612f7d4859f91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
819a67ac367cdedd1770d241d435e432

SHA1
05af6cacb5c67f6355dbaeceff49a31db24b4aac

SHA256
53b306448df3adde70b9028f311dd67f649342f2fb4367e4fd5e561e1bcc119d

SHA512
044ee872a995c1bd03880623bb8aae29addf49ac64f8d5f8701106ce98f0a270f5893963c2ca4eaf30bad9d393a22de5116de177854999fdbd30105e953a1e26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
757c5b1560265f01844935611dbd755a

SHA1
0aa034dc49bd46cb2f5663cbd7a07314fcde42da

SHA256
43d1a0d0ee5627d131e920cde6a73e7dca6a0c2c9fb5ea3569ff41addbaedb6f

SHA512
10d1a856759420132a146713eb1777073b0837166e03a0aa37f014a07cc26a08d6bf435d570fc5debe41f6ee005541e156605dcdc282633889c407b83c1c07bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3b041c9044f838ab0a33be60b0293bcb

SHA1
35d9a1e10ad6ed722a504054c89a3f2f0c2fb39c

SHA256
3ff155af985f33a0d42f6ae7dcb3be5baf3693117f0b53373a8b27b2e478b70f

SHA512
bae4e932f8876a12d7e3b85d47698df9d92ec9d3b25cccdf54d30c4c77633d726d9297da3e421a3c6089b0f43f5a691e2e15d2ff87dce8d3d6eaae6eb9f47fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f7117d323fdd80de83fd62f50881c22

SHA1
a0929712e5d45fef59c454755f8421c8dad84ad2

SHA256
31fb8d941b103f20235676777f21ae90c765a2c02e353c49d710e4f1c5ac6ee4

SHA512
ee99f5ff47e4d9488fd32ebf8dcc32860bc3ef3775e2fb585fee7b4f10078f6d796e9d5b79757fb57260ad9ec17fb91625097c9feeb5395450c28f523f777f6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e3cb44496c8be7c1d3619a05efebb97

SHA1
17399a4f6bc218b6c02cef2c4e6d6a56708ad211

SHA256
06be1415b87125eb831ad4e67b621ed5ea195c0449f8c3ade8533f8eaf0c3729

SHA512
8191ad9bf22265db2cd50e64e85f9f23707e167676da73b48fd27cd788fa4b339780172ad6796ba3c31a8ef589ba7d30c008f71c6ce82430849a36ade5b6d5d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69e7a1f32aaa44a432d16e586f8e5bc5

SHA1
3882cee3d306a989bff4da1a10b5162c9cbee8e7

SHA256
6b73792121fca6a3259cef0f6190abc84b2fc31f56fc5184ae3ff441c8faef42

SHA512
b92ecfb145a61dabc33e6a2c94a4292fd6dad61a68b1eccfe79c4bf761f0794aeebf7b730d9f6f304b6708e507fdd0f76caaddf20cd2301ab060c9c46409d622

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6802420b5462360278c2a9bc330006a7

SHA1
9bd01c766482998d5fbafadf823164857ab027bb

SHA256
8745dd11ebdbbd1944ffee73742119e8a3cb3c57c12d4aca55e0cba68b2d7b56

SHA512
5e8481aa681a33e16b6306860ea7d20edd5a165899c5736477f862d1f36d40ca5c75e8cf75566750862b0d05dfdf0f08d1a57f13726178df0e6faa4c3df18fe8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d93f0185ceada3e8226326d6ba6fe441

SHA1
ce23a8f941ef778dbc86ef879865941af0c27c5b

SHA256
ebb5c7c636ed6ed568c1fcb0fc495e6ac8b68b982ac11b9781e85e279a56c384

SHA512
627e310d2963e59292bf8f08b06f2c3c85304b98e49d506c58b090c1660fb5d9649e481a60679ada34d06918cfe258d56eaaac932b93eb3b19155ebc2a59cdba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4434.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4476.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit