6c110651eae607b2680cc12c699e0c0bdc4508a9515432595947b22b32349531

Analysis

max time kernel
68s
max time network
136s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 04:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d99699807a42d50daf4625ccdb3c2b74_JaffaCakes118.html
Size

3KB
MD5

d99699807a42d50daf4625ccdb3c2b74
SHA1

f3df35c091996b97d19115bca9d577ca4b478e67
SHA256

6c110651eae607b2680cc12c699e0c0bdc4508a9515432595947b22b32349531
SHA512

b89403a6dc85636018ff7e979a1f7fb2cb15b11edc1ce504938202bae911ec149f59a43de09c10f7b29977abb2c5b2da5c2684a8976ec8cad5e280f12d743640

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000006965f0d8cab401154560ae692c86a2cc7b05aac28e9d7bdbad037b7af7de18ca000000000e80000000020000200000005d92c3daaa79aae2b7a7b2739321655045817906bac3c184eaea6b8f485f2984900000005e7af6acb28040dd3dc2ec8f8244dd3e2ea250ae372fab4096309be8d1ecc20c9f9f7f39f35eb6c13037142d654e2a9c98946c77d7d9680fdb39f4bc56ac69c64d39c549eac40087cd995492511864d4da763c90c649d4ea05f0a75dbdb10c52a3ad60db478894402d33f604628809c4dee92c04199618d816dc3ed5ed362756da704bfdb2bba9c133cdcbdf29be8c9f40000000c602e1beb4f4d8374a459fcb1eef05c321b46c6cf68c2934848738dbe0e1056a1e6ba99de8ec614feb2c8152cc807b479bfb66bc22c47b7d334f0b6398a8c7dd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432189794"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{00E7A861-6FF4-11EF-9218-EAF933E40231} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000bf07b983330d1de8bd3b6e7a3c60c7046114c0146eacfb03f8a55f2fae836b26000000000e80000000020000200000007d8502393e834dccc31e84d9f5964c8e33f4dead4fb7df993fd7d5d2747b1a0c200000004f2d140a707c83d88e59f55dfb82adb56d4efb1dd5668378167e84e83dba4cfb400000009599306d838c3bc1a7625aa468fec1c07d9b3a76529ded62b9c6e63358cf207529c606af0a8e06d4171716d4a1eee91756385d3a60fae4e554edd16c02dd5de0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80a72fd60004db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3060	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3060	iexplore.exe
3060	iexplore.exe
756	IEXPLORE.EXE
756	IEXPLORE.EXE
756	IEXPLORE.EXE
756	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 756	3060	iexplore.exe	29
PID 3060 wrote to memory of 756	3060	iexplore.exe	29
PID 3060 wrote to memory of 756	3060	iexplore.exe	29
PID 3060 wrote to memory of 756	3060	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\d99699807a42d50daf4625ccdb3c2b74_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3060 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c06d9b4f71cc681721814d3c78c5a49

SHA1
b8bece65600dbfbe5884c791085be7c545b1cd26

SHA256
18e0291d81fe741fd7d970eaafcece6882196a3af2340eeaacf68d8d625266da

SHA512
fc2e5ea4e3f255e9b891f2df1aaded067735a8590ad25ee190ae734076157a176042fbc490b767fe9daf638c44fd63f72bac6806e34962cc50623e8691f1a47d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b98e97301183da6ff135684d06fc162

SHA1
987de8f928dd2ee574222b4e9ebffca48fd25dab

SHA256
fdf2b2b9bb38af622dca697bc932471651d09232c52fa33a92c3c2bcf9b97b92

SHA512
7016c010f9b2823f1d3b351bf4d4ee89be47937a90af31e2b4d0ec06f6b33eea51a44a515b1f4706a7dbccec4f388c8ae7fe9c5d8dc4e52c929a4ec826a83264

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4bed4b4a36ceebcd4b7337479043f8fb

SHA1
f4a5807058c26baaac775c8776a8a9f48a087efa

SHA256
0865c71a80b0667b388352051757fb6dd40f5648fe08f67ebde09b16101fe82e

SHA512
fd88406c74e14cc184db5fb6184fb33c4a9ea6b6542036461493eb63aa34c23269a51b9c632f2ed3c23edb168183ea180598c1e8d3e26ecbd1396cc4a2e7d61c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7ba9297eed5aaf1244a6ce7f68552ee

SHA1
2b07837734e990f6fde68759cbb8f687bb809643

SHA256
46b12a224130cd364a2527acc7c3a93c1006e2bef3f8b1e1e8c0cdcede2b988e

SHA512
90987a861922fbb316716eb2a7c7823757bb09a646ee3204e14f3c1cf69c260d158dac9ffd2dad05d50ac6cc2401e5c59825de281cde0d8a35c4208f20ded9c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90c92aa9cb9994f370e410f103eeccaf

SHA1
96b99d9f2663a68cf8507b80b75d5957c14af3bc

SHA256
375dd6cc364dc168419ad23c98f80a1aade3ecb76404b227faf35bb0e06f8eb9

SHA512
f7cc89017fc03d3aec5d2fca524a7d8e825ee6d866703d25f6dff7124ee321072de37ab1226abc8d280e49cb075fad37bbfb59a8aa137131dd412690d816695b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
126f4532bee250564d697a472532caf7

SHA1
0e71f35c9dbba86c461759bc11ee5faa84990b93

SHA256
b045367ff4344e2288febddc85bbed0b761628820f3b1e1b476ae4a7c28b07fc

SHA512
727369c1c1086a374873b83607437cda8c6b00ee412e3b67a73ee4f8c9c8bd9aedc5364f7176126830c9c235a19f7255021065ea4a53eb0c87994fd08478ffe2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
939d7d5d6673bf08e10dcc2e032b007f

SHA1
4c65b379f2e7dad9613d635e20e859cf339fd39c

SHA256
a336333846eda5402730c0a12167cf4a936d8d391f5a6f21656108399c576cd0

SHA512
df2ba4e39fc788c8aedc0286f75d7ce4588955dc148aa24fbaf34bf865682cbf79daa6b0da112c8def8122d06b637734d957498367e168a8e3aa60453c31b990

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5940255d0b86a1be25bfdf13486b0307

SHA1
42be5d3ebef1190e07d6c51739f537548d37e9b4

SHA256
8007e95e8ccda8fc86df784bcc4c1d33b851b9a021ce27575a2479c74950ab92

SHA512
571b19c6318380382d2381b103a38f2c0b7b3bb8c67f118ca0ce88996afd11d73dec77c01588aad97d87b1c441185fc3d82edac3b8e1c30dd4c7de63d63b9182

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4073ef6d3656323f5521bcd17b6f76ec

SHA1
c05ab8a2ed40315f58e2287fcee1ae5360400955

SHA256
8dc31583c7d7a2598d20951417cf74652dd97183a737dad36fd21972639c62da

SHA512
c316b090e3c66ee85e0941c985ff93e58e76351e9841ba98c889d82470a8875dda5fc7d4ea66e6f028e49db04d0bf27496d5bba6ea216b3f1a0299c741ada8e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
757bb0ea95fa6c2edb35c9c27eaaedc4

SHA1
e18876093d88541edc2ed06974245a11e3d3afa9

SHA256
e87a801ea754ba114ddbad1badbf499cbd1607cfdbb576813c8c91521b34cfaa

SHA512
6c4d96721d5b90c1dfcd9b96d296469b97ff9b80c61f4b2228b98b5b4c488e79ca6a8c8a1e4718c8cb37cabc1f262e5e653a6945952f8e84e37a30f4c888bef0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5ac97cb3bf9d49673379f1352d26bba

SHA1
c32b933e3582eb2f59646b8e81e6f18382583cb5

SHA256
2978d526884c68e2acdf2e350649be32652ca4b2fdce1a1f9826092c83568e47

SHA512
3b489a30dfb53bf578f3005d98429fc3543770029ffd59b93d2e9f2087bd257d779a6d1faef3b71e54562fad9b916207fbec51ca72439c3cbbf3c5343afa0181

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1739108e5abeb8ccd5305e09082df966

SHA1
eafa88b3637c908d31837fe04ae6a14f6a87d4f6

SHA256
785940dd0ad585e7c62ee77492fe2c14d85a2047677112d96fcb4fd57888479f

SHA512
93a600c73d3e3ae5a1db00099a842f0e02883e7b8e34eee3c86e70eee17f7a144a1b2c0dafc3f54b26f44ee21966246735e590e50c217a118db79452bf5db46f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7755.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar77A6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit