4b51c4e2f3db69cd3728738af35be3c8da25faf9d22fe38141a61a9aaaf09733

Analysis

max time kernel
136s
max time network
134s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 15:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2490c40ed6747ce3f47f8a64ba32183_JaffaCakes118.html
Size

2KB
MD5

d2490c40ed6747ce3f47f8a64ba32183
SHA1

03ec5f595adc328c2cbe6bcba9f634ad4b78c94f
SHA256

4b51c4e2f3db69cd3728738af35be3c8da25faf9d22fe38141a61a9aaaf09733
SHA512

0f49355ff8454ccca740fe0553eccfc644831631c3bfe5f092f82cefac5a8b9280df9c426d05d0942cde648aa80ea38d57e5a6c4383faa37e03be4932fc0262a

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431885840"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000cb5b2ab25c7617f2dc38550f425cc3857bc47cf67118fd3c0b8d58e45efe4837000000000e8000000002000020000000c6307b44885b5feee3e1adf81462da48a983e44fc7cea626fcb6ba1ca59189e0900000008f6980f7f4e52bb13fd6144d32d75daa4817087424705452e781c3bf5cb99b17f99e44f2798bba3037a15c8e820a1e6bca2c3671fbf07ede9030057c7408d94caf786d8f23641ea7b77ff82502253e8a5f7875e650392f4f7c5a54ad0a86e446056dc1fdd64d0b66e15c1d6634abb218904c50659302d268fce40e192536b540b0f086f119dead6725b11a911960c4234000000023c47ae850bf62c3481b30d78eabf06c1bec6cc0d2ab88a87cdc119e37b811458806a70396af3d3f2c2d80d13a16c5c8c7f91c041e91a3002ea479e4c2a05356	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0dcc63c3d01db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000006ee6808f20c7e180d45c20e20650f7e1c2370ae4857b3e64d41bf9d25aadc80d000000000e8000000002000020000000698f28bd844f96a641457884bddc2727eba347bd67a7c136cf8f236dc28c16c5200000008f5c862b5a4c9f89af0c3f13942c299a50c39da08e0eaa91bfb04f62ddb4c5bd40000000ae79f8e1e47134cf72d10c471564c9c44e6798b6fd6267f6708284ac4ec3e88ff92caeb7590387e82d9518fdf4941ba3ba91411cd59ef00ea3ccfa49bf95136b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4DC654E1-6D30-11EF-8967-F2DF7204BD4F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1748	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1748	iexplore.exe
1748	iexplore.exe
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE
2504	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 2504	1748	iexplore.exe	30
PID 1748 wrote to memory of 2504	1748	iexplore.exe	30
PID 1748 wrote to memory of 2504	1748	iexplore.exe	30
PID 1748 wrote to memory of 2504	1748	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d2490c40ed6747ce3f47f8a64ba32183_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1748 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a1da691d35512b63bbbbf0cdcd76ff5

SHA1
00c465d60a86ff25a63021ca9f285c421fbcead3

SHA256
1de70385614486188fe59187b2f9b94eb1e9ce158a025cdae3a6568064346fa4

SHA512
9ac3e345a11d8d8e708d1e245a46f9890d4abd65028328c1169b3673f1bd89f69fdad5f5d27b0ef69e35c2be77f4705864c6c7ce6eb165af93e4bfc77a16f045

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99bf1a9ce217ee28bad0c50cd2c9b0fa

SHA1
3ef490e472f9cc76cab68d628d44e957c76338a9

SHA256
d6b07eddca8b97afe55b7ab656b6b9587490d09da77a3b3a29a811684271345b

SHA512
7bd0e7c0e2956b55c23d591ce25886ef3b260ff27b549e7694db7cdd628acbd8108a7dfe7f9bdacae59e0207b2727cfd74beefc5a6cac9a9b18d6198ead7785c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b34c4312c806e68b39671fd95801470

SHA1
94638283fcafcff2701a07758611f917075cc50d

SHA256
8c718198722f33b5360cc4e05beeb7594ab34fa8cdf8f8a27ec59ebac3f125d3

SHA512
49d3a84600fab3684a1f0fe0e6dd934f85a6e3cef409797383421986e7f1ba8487349e9f874f6a9976b86c446226d6ea27258be1daf33de9a351f848dd9a1942

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59a6cb5748283b813402d0dd22a51a97

SHA1
dd9c1436e7dbb8de9b123382b2a2ac7fb328447c

SHA256
5468cfd9f0adb6a120b2764a16be31424fa9de9d1df46319a13292afad52a8d9

SHA512
e2ea123a1c073d16e5c3cbbf2c04d5066c3e00b44429b7a87338bf8aa524583d44935560a07a6bc2748d2df3c58b829a928bc84e3d77fffe64d07f23e243284d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
42d384a4f0b32450ba347d7bbe0a4e3e

SHA1
9876e83d411a9fcf6b8919f0d80050058333fe6a

SHA256
4c86d309db15cb0c68fab3014996c4438f72c5e69fbec7464f38e498b38230c0

SHA512
e2cf06960ffcec3322534d791d217c12651891131be1566bcd7aff95a035cb21ec1f4f13ac4b635916fc8097c1eafbe5fa9c6775405fb969915324fd6882ab5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8971f14f4f67d5ff6cc7d230a75762b

SHA1
1988389aee7bef758b6447dbb3a729b7920f8158

SHA256
c44523840a116e87af355a683b2e7880161660d6403d0370bc02b49cb499dc1b

SHA512
ca75f20dd981f603bb2ce65fa00d840c508d0150dc4f50b7d7c873b84504c97e879a72fb8aaf3e576de500f5ab37770d96cd5399582d2fb8cf65ae597d823d54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e40494a0b0b43f88b4f93776d1274308

SHA1
121e0a35cdda1905221c46fa0c231fe3cec488ab

SHA256
335ffdefed383de56766d66ea65e39ba377fe9407ef18fd77ac4579853812ae0

SHA512
fa25364a1fdb78517b797ace1633a413058e072f5879fb3bba96fe2459bae4913b21a554d310d67fdf8dc73ae493f435fbd008e820043fd83ac9192937b6c05c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ef4feaf7afba29724738edf8805fa9a

SHA1
27f722353c1d98270443977653970106edd034b4

SHA256
ab0aca416c14a13c179b21308c59c6e7437309893dbad034a906f5f8ac4994be

SHA512
9821cccbdaedd86e603f78fa849d5e3ee22c78bf91837b7b8b8ca52439bacc667a6a415bc48d9170264895b90d325671858dd31354c4cabb1f652d8f85d931bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3dabae03aece3c414df4fe9e7d64093a

SHA1
4779c701d260b7b7279cc38ab68e5b09c66ce4e1

SHA256
62f034b130e4a3202d797040e30590be54385d5a59411482758ece1f0e0846ad

SHA512
dfeb2ca62b477cd98a973efdd049a68629604efe184360ea0eaa835e16942137b75e4f7223c0da34da086e236ac31b69732b34d84653f3ad326fb831e275f00b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6040c731b7b844b195c4f738da9f6dc0

SHA1
09753d643f892d7aae5fc427cf19f1b7026af254

SHA256
29d6d3701e3e3296eaaeac1891e187f2acf25b74d8005410a3d96b95f7401d64

SHA512
c4801f88cffe4f28574474e23dbb1fdaa9d51b877e0443619f70c6ca3d4a514a7e6ff37684d978a65e77b355dc828b62951ae2d664d677077455fee91d8bb418

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3a5c7aa87a350f10b6b79225e663323

SHA1
271d1e4d737027dc7cf64efacce6ad231cc48e0a

SHA256
56315ae0ca5027be75147239b1ddd99615514e99aee4fc165faaa278949145f5

SHA512
5bd11b167221a1fc8f4f5757623a75bae32f5d3c35d74771cd80171921fec25314f5d48c33463f691d8880aa83569a21bd975bdf0dd7e7b3b43d83aa13b01838

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65cea993b4463d6cd1a0da5d9ef7be68

SHA1
494ac1ff9796a21e62ddc61ffcb7cf81a1061cb1

SHA256
7417b56927f12626dc7041be304c4f1bfade1aad7e7b61f8254be562f2b7c4e1

SHA512
06b62fbf975587404ebe2068f8fbdbede2946e2b402f775dd0a48365803d6a613c1eafda89d2dfb99191172e8cf95682068ed3f968cc1a375cc381fc799896ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
433b59aa7d0d2cd5ab63143d5c13e6cc

SHA1
99b8c48a5f7dd7b11ad7859d0d5193dc862d6cc4

SHA256
dd009d3a5e6f495260aa0850a1326f97a37231eec6e75b16b97651848554e122

SHA512
4ce1d3fd6c4b051a822696d652e32d0d5706100defee24cc502ba9a344358953d2dc4cd5d19575132cc580fc13017674b2f0621c96b0c83eff027df559fc8dcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3e04ff3632095bb38c5e0657a0f4658

SHA1
a158d692347c2a65f0959ce9bc7b747cc09121f6

SHA256
dd17aef10121e2ff00440ede792cd405fbbfb15f73216d2ef6c1c0a1cfe301bb

SHA512
dbe33b91d69a4406d74a66d1eb09c9d32b66b4fb04de63971ec2933d773a5a01816db40c581012c77c9dbbcffb77dc5e3bd562ed9ab263ca32af2103984c2dff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4F97.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar52A8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit