839f5ce1feb0a98a3d4344767ae75532d26f71106588dd3d3752d765ccddb167

Analysis

max time kernel
117s
max time network
129s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 20:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d2ca59a94efa07e691374664af9a4962_JaffaCakes118.html
Size

2KB
MD5

d2ca59a94efa07e691374664af9a4962
SHA1

d0486354fa978f65b5be06ba714bb7741d61c5ed
SHA256

839f5ce1feb0a98a3d4344767ae75532d26f71106588dd3d3752d765ccddb167
SHA512

663bad41d44f90edaba46263f9827ee5a0b9e6c873b0ad376d23e16dabcc747a89adaf48d2908f4b5ec7a7d32af1e08833351407215ed6837b11368d917257b7

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000bb5751a4a237c7d46b43a9ce29a361f6894942711b93c229570c65a159354d52000000000e800000000200002000000075095651cb9309c2b0fba82678458e1bb81ba27377f8b629d0a43ab785a8c989900000003ea4ee5a64246dae5844e1c88d2d3d07e2dbfd6e3d4a31eff09b49ccef3602569f03db34d2518cf2d1de85b7d9525ae59b208e1f1c8c7ce3ef19161c809f2e99c2f33bb4c290a6aab5fca06d0e28b27bfa55d32fccb63f599d32307ce77ffd62be1f1ad834dcbd9c7e61bebb9b87ab88db14cfb47ec05867a06be71b6fa9a96806b16b34fa87a30394b9c588288bf9e84000000099be184059b25bdcd0695ef4208b0db8932ec9e9f28a964e4c88e3a76e4fb1abf7f70a9805ff5ea488735e7c436dad8777d4a6c7a18817590b92182615c38644	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431903306"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f54200000000020000000000106600000001000020000000810e37ace04d299efe3b4a66a4d45d43fc9cf193a0dd0deaaca3d08200e52794000000000e8000000002000020000000ed83ce8bbd52442c43369077a7699a2cf2bccf35aad5637856202c7a86d832ac20000000b895418470b24fd3910db408f1490e4275e045fd5b870eeb34b4f1629ae8f0844000000017c21ee9433726f26712aa0251d7b3e3afdf3e439b620f3fafb31fb8b03e503683e52c87d19e61cd1d4772571a706d6985c83d31c81ec3bddad9c89e580e5b5b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 700ef5cf6501db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F99686A1-6D58-11EF-A76B-E67A421F41DB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2544	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2544	iexplore.exe
2544	iexplore.exe
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 2208	2544	iexplore.exe	31
PID 2544 wrote to memory of 2208	2544	iexplore.exe	31
PID 2544 wrote to memory of 2208	2544	iexplore.exe	31
PID 2544 wrote to memory of 2208	2544	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d2ca59a94efa07e691374664af9a4962_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2544 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1031ce2bffbb93e2822d824207c7a386

SHA1
4cd752557934a88d82c59fe614c72d0a5c168565

SHA256
bdcb06cd9cda1727393b4af230a3b1bf42bb62b993a26cdace9928343e54ebfe

SHA512
28bf6265b67bcfccb6f9c4878838509875de268fc24ddbf4a0100f524cb4844337f8f2cc04c6ab6a0a69610948b704dd435b1510a875b2c8adb2e684fe4b706e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f35512033c17b10da04c56b6cdad1e06

SHA1
6d9a622168e07c2eda1b5a5ce3f264de29d304be

SHA256
d8cab4038c44ce2e7c1a9ace42b32d3a17bc4c78bb3b77f54bb235e958e84162

SHA512
076686cb2bf9509e08646be805ad2c99d4285583f05b795a234fb815740de40757e53c013cf69c2bbcaed57ceb5ecddcd895fe16761d87659759c87ab2b7ac40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4dea223c1effc2d4bc2e0141bac223bf

SHA1
087229d67a08d3882f215c10fb9f869abed635eb

SHA256
e5eeb884028a0cc928c3e25831f2ba4afc4408d1fa4dd40966e86e2cbecaaee9

SHA512
7075f8367e7e546c041fca2407ca7038b74bd2fab2e69f5bc9e52e9ff77d50eb81d1bbdf0ca73aa53773312586bfeb4a27f3c00b91de5afebf79437e4e8558b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d592e420f20fb6e3eb2ebc84456fa14

SHA1
6fed8f918372381c1d8ed32375600be693116f9f

SHA256
b2c21410d182032181586a939806a7281ed29fdd0d5d813838b07a51302f11c1

SHA512
65ff81ce3d8624c45e4fb6a005a1a028e60a4dce6e95a241c5b0ec370014806354d0e4c280e7d9c782a20a97b27645b07bc4b66484ce83e3d3a5c2a27ac843ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7bfe9f0e95397d6f0da06c6d2ab9babf

SHA1
e5ac8941836832f36141f99d8836ed865419ecd9

SHA256
89c3dc7e8dc7d6739b075f372be06b93696adf86e6a9d5f737653267633a4c03

SHA512
4872f5db13970678117a356a7a3835a7c9b7ec07aae469f8c53611359fa0afad59f99c96037f2902b4bcf95daa4c6260fecbc30e86116ef34f107771d145e488

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b87817382cee45bc059b416fc7ae4213

SHA1
b32a43f6d9b4e9ccb8e48063146f5178cdb233eb

SHA256
b826a1c1e4881dada7ffb1af6bf0e20f617745463ad0f9ca5c622397d0c789ac

SHA512
2b968c2483c5593cb8a00db2d7463d6a2871abe2d97e81b2d47dd15ef120605b4dbd8bf6c3ad3dc1d3ea9d46a89b05393dee76ecf5621e4cd2df05a27d7aae66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
76757893f05bd9d1b0a190516ba28fd7

SHA1
806c56c46dc6ea9f63b5b1b9d241c8c5ce826578

SHA256
8b1e4e3aa347fa9e0411c9ea7c9412405395431ec94cf38325ef2f2055ed0e16

SHA512
072deb8b20a1b0e1eae8184f0a2870a9b097dafd9f830d9b93f26e01c5504438ed517818b5026c63290a12599f8bee718e406a9704bef741448ede8a525d3139

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9448b59974e62ad370376964539d22d8

SHA1
370de4e75f4408d4200aa2239ad06582c8a0a44c

SHA256
6b61bf0a89aa7b004e6ae6deac6b3c5514d1c03047e827f9fcccc5cd8fa23f79

SHA512
753c21a25830f192c06fbe8af5e9df0883504a09dcac209d476d95d2d5ab95671918692ce1529842d9cce730998ee3688b4cdbfb58e1896f851022eb03f75fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4ea08aa82e8ddd0cf77df932263c8fc

SHA1
c071fae52a8d9450d413efdf37c2243c1d3b2c6d

SHA256
bfa0d52ef9823accfcae3ded7d6314e118c5e8bcea4605bceaa95d6838a0ca73

SHA512
67d8d19d27a9f796a9ed72e5488c1a1c0a5939c29d46a43a3fc087e27a6468b8d660edd86ba0cb2d2407eeedc81b56e2b78a38c9dd29db4903e57b7a3840db40

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3fea53966a4fc2d6afd19b068ff404cc

SHA1
3bfc5221604402bce11f7d1aecf374cd116cb599

SHA256
56dce6ee7d1fc082e0c05995a2fbd63ac66eaba78c7d5716903404ed8b40fad1

SHA512
234a243a451e74554111dc89910e09e1ac6dfc1746abdd767ca07ddaf1da8e4542069990aaa5e46e87ef0c84d68b3dcbe35f431f8464a9ae6b700c383db5d11c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
653b097d1663d950e1ebba7e087da31c

SHA1
c5978c8998ce3112ff0739001800321720bfde49

SHA256
0b9557ecee53e1991d76a042120c1d241d22af00a65eeb1ddcdb336f1b854568

SHA512
93d4b18c33c94fea874ee9df3311a8dc2330b6f0757f1822c53015d8453315691d8e9cee9b0bf4880e140605ab83a5f74d9689583a32a135bf0543ca6992906b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53069d66b974e7dd6edbe0077ba0ef34

SHA1
37e9685af0dfa07571c139b59dcdcef7d6ae39a5

SHA256
68c0da5b5954e657affa90d804cbb81935ec67e2f3ac4cea9fce96cb54170bc6

SHA512
8afe53da5940ff7593b5631e9e0352a042ff31a46742ccc527dc123d818f62674217714197b830bf78c2cb806d97bc95f1aa9d6348a74a82a12c7db22158bb00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74b6163b65b2323e309ea0ad2baddaf7

SHA1
fa30be0b5f0759a14df0436719d86e0c9ec3a55c

SHA256
d6399acad2c3a846d3d28dc838225884ecb62cf3a858bf467e94aeeb45f34bf6

SHA512
cf3d740892f80540ac831b0dfa0a16d65f40b8aee3f696f4c81e6db19bb162b6f2f0489f0e3a0e3e3f67819c2d794fa384dedbe5d7554ce5831e96f84f4cff57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc278342fe07d6681809d9662fb6ca1f

SHA1
d1dce8623a2144588c7178c8b175a2fa6fa9570b

SHA256
2b33c5259ff6af968a31d7c773af4403b31bb5dda613478994618c22d8758896

SHA512
74f37068f7864a78a8aea37ead99c02fef96c7af494b90fc9f2ad0375bf138970ea0873b47e82de240d1343f74e116ad20cdb2a75e842842f34641d9d2c8aadf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d6a54bccf82b029d8d695beed709a5c

SHA1
ccd640c83b769341356b954351dd5fb761445437

SHA256
c23c34c5f329efa0c6273afcd8dea505c52200933a07c371942c7534c326e83a

SHA512
2ed660ec470fcf252487adf8878acdee42afcdcb6590d43c9235448ce22ea4292c1f265055296973057de1dc27953958ce220a09c7561d2d5af6e3535a640b73

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab522.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar870.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit