0f44b32c0df98fe54ec363679a5f9e4d92a67c7626ab11f25baa53871a258462

Analysis

max time kernel
143s
max time network
138s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 13:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2059c4c6dd11bd98cfec3d69d387aa6_JaffaCakes118.html
Size

1KB
MD5

d2059c4c6dd11bd98cfec3d69d387aa6
SHA1

022309f63c3205b8406f7025dea87918802ebc67
SHA256

0f44b32c0df98fe54ec363679a5f9e4d92a67c7626ab11f25baa53871a258462
SHA512

353b1112253918c296a8548079c12a8e1fdb86fd58905a0276ac28898aab6332947adf1f4d7caf08a65dd5118b65217f53f42d7bbc8fde6ec50c4b32d83054a6

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea220000000002000000000010660000000100002000000073c1c184ea6033ea3b4a2a1c84562c081276b6fa1b7768ad9093b77268755604000000000e8000000002000020000000824bad5bdd77922dcc28981e2b25822c28b294af486b1436c4b863d5a64f318f900000001c8de1549ca8975206c264340e179660fec8987c587aad997a055869cdee7c2f5028cb8b9bd5a6bf682c0b3c5705e9735c46857f167ff3341162a8cd88caa2393e78985399231a09656972fb86ac79f9b80169eb6927519da256316ad61b23badc9af8b6f81cd40f7550b291c5bb239766e673ec39851a6fb248c8dc5fc1119dea3ca96b0c509f00a6468a579562985240000000cd4345c60e29cce52e0b87a6a6630fe73660ef1a9093672e5fdbf2f720e854342d30a55543cc77d4e3f8ccb6628217da70e944d7594d198b948a423b3708e54c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AD269EE1-6D1C-11EF-9733-46BBF83CD43C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431877417"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 009094832901db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000597291c0b7a251d3deb851831197956bff376b603a97d01623aed51298483eba000000000e8000000002000020000000bc98d3975c2ac0c2f9ab67c8e314a5a3f3809d2ae8fccfeb67389468d137f98920000000c37f530c1dc9b70c68c601760498c979f54936869d95aba1e597904e2c99290740000000af66c94fbded60b9f9d6f6420f86b765fb9c0d3fdd87ac6d0f7d8b40b4b89f6d10497484fb9506f99257d5b002f7bc5bfa8a735f073161dff26b3774ee48ece3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2388	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2388	iexplore.exe
2388	iexplore.exe
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE
2180	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2180	2388	iexplore.exe	30
PID 2388 wrote to memory of 2180	2388	iexplore.exe	30
PID 2388 wrote to memory of 2180	2388	iexplore.exe	30
PID 2388 wrote to memory of 2180	2388	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d2059c4c6dd11bd98cfec3d69d387aa6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2388 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4869a484d12a8514424c6a0118708fe4

SHA1
d66c2b7cad9cec5ab4d493d9a021d7cf08715a7a

SHA256
0c3b6352dcfc805a81371ccb1fb9e7b15b7dab0cc16317d24ccaf535735c3514

SHA512
4e0de233ce36e92fb5329d16f590e2c4420d0c79143acdc6e522ab720a70a5de504bc41b3bd3893a3f5a59162a55183e9718395e85bc92e4b41a9f9038b913e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
978a5cf89cfb978bcbb48a494ecda80d

SHA1
f3252eb1c3f68da36fa93ccdd7824e4db5804251

SHA256
1accccc2c8e708b29f42a3c9bd188a2db23b41da9a5e18a045008b8237477cec

SHA512
98d7080d1083db04b89d88096375782ccc0c89f572e9711162bdb49daf842bbcf7177413187cdf497dd7b20990d2fe98c8a4c05cb48de05d3b4e782a5412816c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20aea420df12b3e0d082541d84108466

SHA1
a889b0dc75ff69345f58fd955ab1b5495b8d1647

SHA256
4283b0a5c354fec8c779db30f4b89a1f3a971fabe225292a1be390a4e2763736

SHA512
33229f852db887e713dbf3b630294872ad0d2b878f15e9a1eae04ac66ecb274cdc0c0543486e60d793df5a6ab7f1989c3aa35ec4ebaa317d36221202c4bbb751

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d9b1c547ad43681a51b3419abe1f6bc

SHA1
d689ddfcaece6873009a984ee7819f22e0773485

SHA256
0cf97ab2183060e8ca90952f15ce399ba7c70dd01c1d182ce182de675c218440

SHA512
50ad576b7d1690ae9e58de152a7c79700a27bc5333af3fbbc7a3f2d7a1cbc94a4bfd57f1b6ce1bf2304483dbae7e7f864025aa211058fc249e5497e809dca43a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2fd7a92bf118d872f6810c335a26946

SHA1
34cc64cc39fae092cfba34e7fcf0451de7d1af06

SHA256
7c0ae0cce221edb423d0ca22a7b88f613e05fe3d6155cf15b06439cd2a4f2843

SHA512
08b086e12e9c99f2e2cc4d102195687915548571cbe88ec7cb113817d435043911560b6071cdaf454fc6b908f195413c2901b3522b0b5c3dab80791aebd1a867

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c94b70fd09be78d7edd053d9b80385cc

SHA1
7ba3f3778d3b8b75b2a5e82a1c6314b8ff6558f4

SHA256
c3576343d03235ddc14658e367900c0575a9d7c5fa54cdc19c0b62198bedd570

SHA512
5680ed34abbf4a9868bf57aa9807f9158b82a8d8d9cb831f8c7deb454ee8aa6fd97a3a513d4d091d1f39434d53cf8b841061c11baaef46597ecf681ece3eaea2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
baa209049526517036de68914685f4ed

SHA1
feeba2e30911d6fbd74964616d614186bbede85e

SHA256
364b6ad2d2536d459bbe7879a5be033435fc194bba926b3326a953632160960a

SHA512
55e66de10438918d27971ee683eeefd8e677cf8195f7e9b2f236d90509a6a39debcfd465aecb7abf5ae47bcbee5c22eac21ca22209944dd4504d6725a555275a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ab9f4f30806cc47e53315be3db26ddec

SHA1
4f8f95f8b452560db0a634af6a74c5226c6dfc2b

SHA256
3225e9c10adcd65517b2691f55bf4a98b26a15b3d3744a4c751d40662111f0be

SHA512
b621f145f5558c223724dafbaca68afe551eb9d927191abab5961a57a521c904a06be2d4f76d7d707e5d17d58e2f4e57787c02fcdc864fad49d56799ce184c41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7146c100c53866fbf0ed0838871a2fc1

SHA1
e486b6c1af9447cc70022856ed637457dde57b77

SHA256
f96e1354d3c7f94aec8183fa6d47595aed88b4347895d04c178b29bfe1964562

SHA512
75e889de5cd0fd8f0b8f91ffcde21180e265990cd0599f92edf9a4479b7c025de71a7a366dcdc149b613d2b5705ee7e46a66b59fa670e223d5cbb1feb982496a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA630.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA6E0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit