4533451e956e3c60b7db0aeb26a7aca086d0b055a4ff9fe72a3db56922db7f5e

Analysis

max time kernel
118s
max time network
133s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 13:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d47732416c07744c339b62e453c40d9a_JaffaCakes118.html
Size

6KB
MD5

d47732416c07744c339b62e453c40d9a
SHA1

a399916be910f4f83f84744ba89192e2c08a98e6
SHA256

4533451e956e3c60b7db0aeb26a7aca086d0b055a4ff9fe72a3db56922db7f5e
SHA512

351a13723aad49e79b5e72664283d640ff2b95824093341e9aacdf972c9f8407bc904b1891bdcf74794de20ed3ed24000d354bbde6018825ea1c85c7c26e9355
SSDEEP

96:uzVs+ux7tHLLY1k9o84d12ef7CSTU17aYcEZ7ru7f:csz7tHAYS/yaYb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "431963917"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000dc3b6be19b278875aa194399cebfc7580900d938b5d2844653a60e77958f28ce000000000e8000000002000020000000420f1dc2303c2d59e5ae7a96b8d62d3574ff76b0bef6968b2342d1226aa0721120000000e148e6c53ced386a81ed467234416bb7c8402b83207670803e3262a267f520a340000000fa39a3761f759f755acb83e340058da81df46d9e052b9fc9bb68685852d3b3c2b5625bdf5805e8c20bbbae929fe652cec40fb5e4094d8a9c3e7600366f30275f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{17F0A031-6DE6-11EF-A1FD-CAD9DE6C860B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0f7b9eef201db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb90000000002000000000010660000000100002000000068068ff64d2abd12aad1bdc3ba30f6c64a0353e7b0b6d059dc6978c7d1477235000000000e800000000200002000000050c4be930e68c0427fbbec978a93ce467e87afe9323786a16f18aced32498b7b9000000088a6da258ea2353e3c9e663e0afbe99f06bdc30e5e84935cf0dfb4fa6298517f5a5b6956d58eef5c051d910343bc78340fbaa0661a784bc1ed5b54c4bc0450853880305c88fa64a4d04e0697fd6523465b73c8a414797eab2dc597f0c1846a47909379fc8d6efbf34349bab190754b79aab6a7d9f630d127a6365c8d7a9d59dd9a7332a130c0cb4148ccc8c40eb2af4640000000977e3be25ab1712490040d6c5a39a43b3ef314a890d2ba0977d87391df1df2a9ce504c423a1b24d167299617d9a142b2d996a51123862c3cd2e474294920b74e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2096	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2096	iexplore.exe
2096	iexplore.exe
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2468	2096	iexplore.exe	31
PID 2096 wrote to memory of 2468	2096	iexplore.exe	31
PID 2096 wrote to memory of 2468	2096	iexplore.exe	31
PID 2096 wrote to memory of 2468	2096	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d47732416c07744c339b62e453c40d9a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2096 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
532bbcb49338049f04768e62a83de343

SHA1
472089d56b304dc09736d37e47b84a88793b874f

SHA256
8cf635ec7dbe41124c88b8ad626394425e2ef3f5867e10f06b68f241092b085c

SHA512
635026b802edfaba7c04934646877ad578321344da66b777778eda112c91d8519388386925331874b0417b5fd555f03373959aa734fa9edc7e32320259da8cf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59ed8c1744f0eaf801fb3f1ebb15ae85

SHA1
c9f92be4de29e92b7d68bcca63a4a92c50b38eb3

SHA256
a07cf198bf29d2c17c50f74a3e1d3fc498226117ad01293bd184d98aa20955e0

SHA512
9ee3828a47cce5d6a22e67d4d2629408d2d520dcdad8a6aee8e8be9af4b975ef5adbc47081d32d8f21e6e3806c4effa97064dbd909eddd3c5725afa34fe4d181

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
603e311283b5ba6af90a568ce1bb6d09

SHA1
e5e9d7e942d1bea8ff871c47bd1f99152b7a0953

SHA256
c08d3389635d135663457e36db51b4919c466121735ed5ad9a4163b56fa4fbf4

SHA512
e29b7ea5c1b909ecb312ceeb1d773925dbccd41a688b07380629f1c2a25c547850a54019bcc7b697b5e4d6b0e483c1073fdc262b2123d1eef43e638c0f235b1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15382032df2328cbe656f2cbf0dd8d4c

SHA1
66a2aad39a5cd3ff692249ed8ccfdaca2244ebdf

SHA256
59df4489b0d2da8400292dfbda9296737da6e4c28ac25936161ec9b9cdcfa745

SHA512
333a46df69d8ff2446876c8b0b233547a70924977cc396802119f6653e8c01c6ebd8d41b8b09f49c907ecacfae86ab829b8c828f55217cf2e393f2f4404e6ac0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15ae95573eefb10e16fb1b12e4068cff

SHA1
24f784fc7d66610de542669cc27c3dd259156fd2

SHA256
1e5dc83d50c69c2fb7049e1f7e5523b270ed874189ab21aab0507315d46216be

SHA512
394c7fb69d58b444d3d86df4f959729c4a0150bae5bb1403ca70b26bf8552aa4d051f3138392713f4c68a9ff537b42a415fa813082fdbcddb60bd048972dfc9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd7a1ebb4a56abfbd39a861955cb8f92

SHA1
bb98e5c2cf0926b1082853d47e6a7d4728ba2373

SHA256
6cd79342204cb277ba97fdc19cea4412c7b8ee4a118441945a100cff07e75577

SHA512
86070387683f190241e48f39da1ea91aad479bc91656abc2957b9b17e203fb57d86c1d57b337ae2bf2d99b3a047353fcfca7992ae2079e458d623519127eb904

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
824a512dec9955e8154206c04aa153b7

SHA1
f163338e70342902153a2d18a89d118c1daacb17

SHA256
b78e797e6edcc2fb3870ab546dfdd03b5649c77463663d5fa65019d28b7765d9

SHA512
52a18e81398b502a4d82f43404aeb3920edcdebc61f0e1edddece7fcf8dc9ae2507432596cc72f293bc5a3050124be4b5bc8a9eef6c74a866e097820de6e16df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
135df0a00c2655e076a82bebd15a4c85

SHA1
ad36d52e638e0efbe74e7d0a6e4fbd2b462ffed8

SHA256
6e740bd00177cddd51a23f39136a3da022fde4465d1225067887ce42533167a8

SHA512
56ed5b34981978c33417b66c1b28770c3de1a5e2237f0479f3da065af5b01e2e8de886c66728df85312672d3f3e60cd505eb4f4f98703f5d044e363fe69ab9a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1323941107cc22f96d5345712e9ab5e7

SHA1
a92b6ab137045a3540fa0be76fb5f1838d3a8579

SHA256
9e64e3d5cb7cc60a798832a60a6e03aa68658e026ac46854cdfd5eea1273b926

SHA512
2c3cb1f46fd60cdacbd9d356de58b0fbc8436c5f7f18b4d4450f5ec9339be93ec989d95d998baebfc9fffbf24751d0ffdb2f7597de937e3b86d21724fd99bc31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59cd8a722ac7e638600b679761602a34

SHA1
4ce15d6a585a6f6e4d82ff9f6943fe5c42c51f0c

SHA256
2aa1f87bae4fb5e312448eae9a072d870d681146d6dc3c09aeabd35ffda02cc4

SHA512
22cc7b12ae875174820ed39b59afb6538c5875335c7b904c8c9b3a3c3a8ec50c3eb6da70c6ba46a8f47915007271dc4f655caf027b29679e6f1019da76d9a5c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8df7596ad8ac30bb53d420c733e0fe6

SHA1
8196941ac2e9476710fbe9e38cde33bb472ffff3

SHA256
fa5ebdb48017a26048f6933ad9c2f287c400a5cf9dab04c3b0dccbb449fc3ccf

SHA512
47cb340986e145b13445514d25286a46e7760b7d77e6ee61358d4ea1f9f76ba82b9f38e43b8b9c633d83b303b1c34bfc09292aa1aad97883d85c831ff7e0e210

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ea826ba8532364efff24a6821424d92

SHA1
f7e95224cfb98d0a1fa46ee10621280c4696f14c

SHA256
a9d76ee49d544f3b56491addc0214544c3cf9eeb1839f70d17a368247d83a236

SHA512
e12611cacd6cd8b5e812e3701fc54f9dbc60f06f6977687e4b2fbf65b7cc6e22a4632f107a134062f09fbf1cd422d5234b990b260dc38945ab0a5b344a371fa2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed850059fbe84f2ee42602181aa6b75e

SHA1
94a47f37a4fb092ee556f77edf3b90782f7d6252

SHA256
d187100105421151358cb10f420a68a9cb0892707b6bbbc74786fa8fbd71f17c

SHA512
47e8207c07f788b05642b7e41fbd999f58072b6ccfbf09c3312dca6132c38e6bbf3c059d0999d83a3351031fb53e644439eab2a37eac2f65d3e0e966b6c6192a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
888821e9452095ef15beef84314bc3c5

SHA1
a9f20595cc7ce05c308eaad2f1d9ad69dcf4c044

SHA256
32f0fef652abf1b1dd1bff10b5cac4dea2304c478bb112b88a083091500947b5

SHA512
883d18b7d0ca0d541611040a214a000465bc8f4e75064543d46d57432aff9ebe65157242771de835ed4aa1f438909ea8a35235bdad60aa7c22313e2896accc93

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3D80.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3DF0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit