2d20903e10170e678be7515daaa5e6f50cbe451649e30ffda96da46724dd3a36

Analysis

max time kernel
119s
max time network
131s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 15:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

da9fa7d5f1fed7f24e2c68742567f64f_JaffaCakes118.html
Size

420B
MD5

da9fa7d5f1fed7f24e2c68742567f64f
SHA1

18ddd70b336604e6326cab1522bb4cbe1adc3a2d
SHA256

2d20903e10170e678be7515daaa5e6f50cbe451649e30ffda96da46724dd3a36
SHA512

04f87c3f2cff98886378e748cce93f59e4f1af886bbf62ed2863395942322b93faeb4f6d8e46983947a5a2c06dbb353bfbd40927e46b8469e51b51a422b3b3d2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd3000000000200000000001066000000010000200000002d0243b455042aaa14aa70b513b09f532e33947c0af2b5fa46aaa17a1aca89e1000000000e8000000002000020000000299c79799b63257aeca58c3ae8bb5c5f97e7c76eeb6f7403ff0db44bb34cf28f2000000097c32c724d434ad60e1dfbfa53c030c167746dbfe504388fef860a4f3c65e7f3400000003f729b3afe6d814d1d343331d2f847d220506ade06ad465935173cab913026caee5b76a3742a252f9536b777f2ca4b90c722a7c6b76ba114ba4102cccc18e2c0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{28011971-7050-11EF-ABB3-E67A421F41DB} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd300000000020000000000106600000001000020000000520f2266665a6f1c893b0d2834d758e2777552ec850aabeb786a77cbcf2ec4c5000000000e8000000002000020000000749f498db4c20dc3d6fe956ffa59d102707cdddcd7e4826bc603f0d0d30cef6190000000d13eb23401af99b7cd211536bdfb48e94e778c0ad798efb679b3c2a0c13c72fe96867c035c878b9dee2533881b6467456d2217ebaa1bfdffb88fbcca1d741c0c695692f549da37dbfc0d93f802ff727c59656367aed10daf18ba89a180f1fabfe7c905b675c93fe3780846bc3a09767019d7e2d6fded9c7909e6bb36680f584f45c04f2c09f09c575339b44ce3111789400000003355071a656d743345c8af4a3735c6a6b47b070146a623e76f813a302be3d980b1f372968d2026bbe43997c62ce04ea178570989e9759d0ccf286a0b9015fb4f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432229375"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 40b7f6005d04db01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2168	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2168	iexplore.exe
2168	iexplore.exe
2220	IEXPLORE.EXE
2220	IEXPLORE.EXE
2220	IEXPLORE.EXE
2220	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 2220	2168	iexplore.exe	30
PID 2168 wrote to memory of 2220	2168	iexplore.exe	30
PID 2168 wrote to memory of 2220	2168	iexplore.exe	30
PID 2168 wrote to memory of 2220	2168	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\da9fa7d5f1fed7f24e2c68742567f64f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2168 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d7c0eb205f8d8904460ddbf63a570ef

SHA1
2c2ca533bbc4bbc693eac92513454b35c276292a

SHA256
6cb56c0ab1bb4401b5889c9dcce899800c2d8f2c3f9d5d515867b13a2589011d

SHA512
fadabc4f7c891bfca2cd912fd631274c63ec8ffa94709bbbf50e494adb9d6666cec44cde3cc71537cce8adabe3f7ac78f1dc5eb64f2b1f2765038f52bd7a4bf2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f06b6d42b0074fb7dc7dc82270dfcd16

SHA1
39bc744b61d7181902d9932df12632519c7e834f

SHA256
3618342692ecfb3add5b201bc9ea0ad0edb4b77f4c13a60c440e07f85aff8b2e

SHA512
9b5daff64e2adac34e4751b7a61435651de25b9e975b5a0314d85e1bda680b4c5810b82c87884149cb846b7f16e2145ce06d9b5956e142bb86cc26766c7062d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1e25f9efb8c88accd339aa34ca6e419

SHA1
fa3cf04deadbb3ac6c84e695dce359b5c01baf6a

SHA256
fa4206345b93b64e0818e954c462273be7d53d8a30403f0f7212c15ee91cb506

SHA512
97eb44411d60912810c906860bb15c5087aba4b2c2c7511f4e4066183270d89ad68b2df90c64c66bd1b1085afcc8894e7ef8cf69939a53d647617e62b358c92a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55a5b8ddefca7f6977b09f86f0dc2eab

SHA1
f11e6171114cd69fedde664df85a6347f3670c79

SHA256
34f7fbca7207a67f4c4c35c950451db2ad482a81fdcf46963ebad9abdc8ef38c

SHA512
1e930788b5eb1e40f5c407dd3634963244f30e76fd2f5a4bd2a06c3cf6dbf99f260b5e2c19f71f6988c70d700b39dcc38f2bf2e9fc620913011ed4815ef33d31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af2b8cd7e5eb44fc59e3b425b6bbf5c5

SHA1
1e6be521b531c3dbeb87a324aece4518aea2bf5e

SHA256
07590b48b0b2d0bd5cc8fd4485c1c2a5421414b50ee3da781d49f4f1ddac68fc

SHA512
78a9ba2043495f9ceb9bbd8b9c0584161fc0ccf95509cf9422164bdea3247600145affcb2033d42b0777a7f06a845206b60afe4cca2531fe15b2ca909a373cf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
764a7c9ceeeaf6982de2f89913b662b6

SHA1
6d958ec7c9ae5021cd214cfc740d352b84348050

SHA256
5faad70f5628f6eab2f5c9d432ec1acd458a87534bad9dd5b68a42612098e611

SHA512
6270a00ff3ecaf548ec9cd05e515d553d65e26d168160164dcd4fbd9226632551dc34d4b9920e2d7b8689e9eddb2cff65b7d90f2711b306331f741d2b8cf7583

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
696e85920c4e594a0cfdb3e3824b80ae

SHA1
7c35032fdcbf9beffa1501ff9c16703bbb26fe51

SHA256
1d69f3adaf29820186b198d9b4c9510be21ec9caadac0e0a01476785b4472693

SHA512
dbfc9eb40c2dcf48a832a2436e4c1b81eb08f9af623d36a9ab540f49e601f8fd20959a47dc61fade7e8e0382362106eca9849bb02385a26703449ab39beb2bcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd6130f03c3d2cebd401f8ff081be174

SHA1
344b6b60cc9d9e856d1eb4b1b44075575eeb24ae

SHA256
a46cf1f1fcbc3205fc62b8a34072cc360216dd0e9d798d406b3e15e849601288

SHA512
3243ed17807b24b7e5b702ba770021b2111c8b43d28fb8aab7ef04059aa853b2d0c82b7fbef7576569c602d89439a93da9da254cd7a2fd9730913fe81e55be95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c25a7fd6c3d1a15ba003b7249738c71

SHA1
8f6a6cb184f0c8db276969b29c5ae99f16955b3d

SHA256
4f2e2e2fa7d63a644160b9676dda419cf7571499e10aed354429f8e3bc7f67b0

SHA512
53e92454518111045e4c161b2494f46598ff60286b06d5a3ddcfa73d70f4e7d430e0f638de04c06dccca801a5229e2f2470ca0e2c9117508ab69e7b982b0782d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
659aa15d6176c87a269447e16733ec5e

SHA1
45e2e0ca602827e67ed4c3a577ed12207897f3b3

SHA256
66ce5332b5cc27f07d76af9584658addb5ac9ff182f2c559155aee01a0383769

SHA512
04b9a0bad75ea931855a98b2f3acecea6f4e403f76522a68bd43a6d230f55e0be8d8bea2272ab75da7cb592fe1fb532df37914e833af03e578fdd449fa12b400

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fac7f3f5a8fe5faf9a4a09363d3bc93f

SHA1
cc7e303826ba5e1bede7e056e8d85b388bb31a63

SHA256
2d255d73f30e0564bcdd63edccc5eda48fc5019a7eead63654b7642d6005e034

SHA512
b61edba594f22dc97c9bb9406a1b9c82a772c17d669517529e4bda6f410b24e8312a532732e6a11c896214ca031121cd44770b7a1a6129ae959f80149396e225

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be1963be6310ef21905e072d785af39a

SHA1
0662be9ea552abbed31f4aafa15ef355ed0ace2f

SHA256
530ed47805e7794f3ee464e781944a2bbdd739af1c9ee2860fac9db60987f0eb

SHA512
c96adee32dc691e0beda594f32e336522f6343ce3aee87eef8c9364ad3c324f0b4af0022582b50773cbb01133644ad7eb60502953765137d17f62511d2177282

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6eaf7ad06d7300a478cc4a30f914155

SHA1
21e5c16deb3b64a76b1d05a81b2072027f375fb9

SHA256
962daedb66632c3c172711809f3470fb686f06d4d0b4dca5f988e3880829f1fc

SHA512
93332ecb5d85146fa78b7a5aaed0d18c9e0c2eed84345ae583dbc391262916f62b0513904ba6d6e1b1d5557ae2b30170f8dba8542091bad4c8ee18ea525e5615

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6ac76bde2b520e32b3684d9ee3092dd

SHA1
c2efea9f881fdd69c9ba7ff5736916e430c6a2be

SHA256
7ec836b84b69deec64e0c9c51814a050c7fd5cdaa277d1e5e8895ca7c2da76f1

SHA512
67a788cc06361eaea45b7428ea7857fad6f1018f18900a6bb09af7dfbea823b937733033d4fb0b5ca7ec065ffb3776b4fade9a0ce88b95240f6e160e9166131d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD76E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD7DE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit