2d085e65943c3fc56f2613d1bac70c6d4429eda7e2ce97c15f22d383f709b4e4

Analysis

max time kernel
121s
max time network
139s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/09/2024, 21:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d71c4b7fb31830e6bf915434641c1ba5_JaffaCakes118.html
Size

1KB
MD5

d71c4b7fb31830e6bf915434641c1ba5
SHA1

71fe791c0ac7f8abb4a58cfa5d0c8969e619ebc0
SHA256

2d085e65943c3fc56f2613d1bac70c6d4429eda7e2ce97c15f22d383f709b4e4
SHA512

26cda06126ec91c80237ae994f6f4ef6d5958239d2153a3e2743467165037fdb3c1247032060df231d8c1252bfcd508664fe1c51f7e6c94e235cdb55d6349724

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000c1419f4195a0122808f6863e040a50852483f76f6af90da4de9bd3fdcaf8a9cc000000000e8000000002000020000000d1cb39c217e86b95d2a104b5e28e5495d9a16ee703c787796debf70c95d0913220000000e046bfd0a8925464f282e16e3e2cf49a3b1339e6a00806c528e6e5d12715d35b4000000055e3f9ee588b9311294fae3f5210211a72f75c420b7c1b7c44daeb80dc3f62c4a2e1f009c29db474d18db97579689f76a44ec232bf3240846d44c711e15e9a84	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{49A68431-6EF1-11EF-8B76-DA2B18D38280} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0a36a20fe02db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432078686"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000351f4926f93797b14870bc95873da7b72914672b935ac67dc8e8428a6a281e47000000000e8000000002000020000000904940064df3b829465dc471ec6b427fd1efea3226feb81588b4757efe480b0090000000c6e857a9e8de77d034d0909391cee277e737c3917c5634ab14a02896ea85d884e2cd49054f83aff6bd53e6d6e532d19903cdf02927f124ce7a4c9b7cc98d925352fd1d8e464e335b419960d13dd64590fc3f20269371d2c65a18e2e6e320a5eefba0fbfb25760aade04ee180392a3731bc7912894b5188fe492815ee26719a2d3a0560297b1871a7610d7ee7a034c3d240000000c1dd8766a72b0ccaab324737cbbbb55db7e13ff1771443e69393d1ab14e85b65a84d600e5a37a9417c4a48ffd8a0fde84c9a748414d531b8cb23b4156f00e44e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1700	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1700	iexplore.exe
1700	iexplore.exe
2488	IEXPLORE.EXE
2488	IEXPLORE.EXE
2488	IEXPLORE.EXE
2488	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2488	1700	iexplore.exe	30
PID 1700 wrote to memory of 2488	1700	iexplore.exe	30
PID 1700 wrote to memory of 2488	1700	iexplore.exe	30
PID 1700 wrote to memory of 2488	1700	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d71c4b7fb31830e6bf915434641c1ba5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1700 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
ef0951142c509601e24841d90ed46e0c

SHA1
c148745e4f8f9172344b50e5e4fbfcea77d9938b

SHA256
417a825810a3c733cecbccc9f23766fdc9f635a963e5baa64f5491ffa66acb62

SHA512
ea76a95a5408d0252804de38350908332f54b3a35d66bc83eacbb8bddef37369e546fa59a4b68b773aa9d227565f6ea90756f1c8a3122a30226d0afc573d0bd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ddfe54176cec9275e0d12df519c691c6

SHA1
09eedd0b8540570c62b11df0f9f617c98ba11769

SHA256
d40b17eaca6c3b75e2ea36d4dcd6da1388d76636000dd7653af5be7d99a7f289

SHA512
34615f3b9adbb4bf34067ceedbf8b10c9ba6ee0deab2ee993d2741541e265342f29c35e8ee18307594b237fe07a464377cae6b065a188d281a1ae7610dd53411

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e55c8b77a201b82f6a3c59e12fcb94e3

SHA1
0efbc045c03a9397e9bc849539aed10f7eeac6f8

SHA256
c670e0a537b3a9a1d28bf928a10d0c2863403d74e79c1ef9f98990038e319a8b

SHA512
a668a1c158bbada2a59332c33697690932d13946f9e0e98221979db55f00fd775a61d14504fa281ec27ac06c7a59110764887399ecf234f0ecb3632c5433aaae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1a8b333adf7962187d2d42e5047c6a17

SHA1
1e2c0edac081250e60200ef3cedd5004e7365982

SHA256
1c94b1678183d03cf913a849afbd48664db007f3f679f942fe796a3777cdbed8

SHA512
9d144c043f8f199610a6ba6f36b866dff5f7257aebdae63bee61b69711f5185d760382233819891f6b57f82a2ec4a919edb8351baec47730674ca44502615235

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
edabbfb7282f3425a33376f335ac39a6

SHA1
7f20d78a22b65a4210d119872a5d7e03d5ca8b0f

SHA256
159b21b8249db3e0b38e3035963477d85b86e86660c985e904762f7e4aad8458

SHA512
22524a888b05a658a6a8df7225a971bfc8b2059bd2be8371368414165671f3a5fe15baef303b81c8a95ebcd3fb0ab5cd80ff7271d598f226061ca0fced62ddde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c33ebf5f666ad65b992f227a61251580

SHA1
2674e36e7643124df690ff1ae97007f593a9cf05

SHA256
9bb43ad72dcb7aa8a433f8dcb6a47786f596c87982d708192c1e96c844b64501

SHA512
728607969d0cb11c3b65dedd7e2c88443b8291a41f55b1058402a3dc990bce41571403a2fd0c7a9fb3f9f5ac58d75696806b4afc8bfe9f101ae4d43fa2d8827e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
959d38b0d05cf4f74d45ed735842d39b

SHA1
754ae607fff9020ed353840b6c9d88aa5e69487d

SHA256
4bacf805ff954937dbe4b0125093421d3ed6158a30858518a08bec17b898f8a5

SHA512
7a21336eb393141edd1cfc9a17ec63a05536de946f81b603ff5f3bafb85a5f7975b2ba3b7de14a9d07559e7d227421f4850a4cc139dafd0b348560b06992cb5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4deb025f9ccf042492a1e42be364eaa8

SHA1
d3b5c35c0d5a89b2d3792fbbe2ae4432f2969f47

SHA256
090b7d5d7e640ea92567229101c3dd92dc9c866853bfb130a2ffe86e3313b9f6

SHA512
cc9b157de91eac3e9a46fb04a8473ad613f15f95db4f2a526ae8c98620d9d7817f72b62e806f5da8c7116d50f0846f79cf1d01b81151e3a03a0ea6f812e5d7bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62ee3140a172a07c0db8cfa5a9ac86ad

SHA1
3ad2080348cb12c06a63df60de30bdff439fd07f

SHA256
daba67c07868725cea717e17852adeee392538a15e9a37c024f94bfc6d0c6546

SHA512
20a7f1bbcad9f02e1b8ceed69d53292940a6bac4470486cfa072bd28412a3eb2fa1c5c5570a04bda254c701db6bcdd0da69da8ac6ad7f0752d4935bf2dadd6a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90e8fda2c2c7dec0782c9466495cdef3

SHA1
d132e8944a4d49859b7643e8e96ce823c7f78c40

SHA256
40fabf9ffe1e193d497e490de24c813f080274c2c7495d1804d56e326ae24e85

SHA512
63f6c69579d7b8b82763599ac21364d7a560b12b791fd7c6e475b9785d00ac233b1052b82875c64974db1b6e7652db967e79a42e546098d282e253f4802b2c29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
cd40c99a2a0d918e9f09a7c5c2638d6a

SHA1
1f804b35fd124db3c283b93bb4f375e0872dfbe0

SHA256
2c7a81ea7a9a5b8ac1e3f74e123a2bfff975e4ca2969c2875db65cc1924b881b

SHA512
c344256f27b35d1109db90d49cb603f28c6648615f800d86b5ee5644000ba88ee6d911f945d9385fbd5b9206198fc5b8d90b800cf7771cac5f5d84beccae6023

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC60E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDCD9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit