972050f99759f04e733c894ec47ede87dbf2894da8e44edaf51f640d5824c9a6

Analysis

max time kernel
136s
max time network
130s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-09-2024 18:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

daef9d3d6fc28ca6c080a0cf6d07d107_JaffaCakes118.html
Size

578B
MD5

daef9d3d6fc28ca6c080a0cf6d07d107
SHA1

c1453caf4f4a06a083fb71f7f518777e3c5b5c64
SHA256

972050f99759f04e733c894ec47ede87dbf2894da8e44edaf51f640d5824c9a6
SHA512

49bcaff91e9344ac76025b80a675e3fffeb79147ff8ad533e3a90ec6558250186a2bc9035148626acc225e02219051623425e14b2dd4a535c41b5c30b38d4618

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000005badae515da00031b028b046a976a3b547d3c2ae6571af8faf391684ef231847000000000e80000000020000200000000ab8709b833d5fefe86c7364db2aed90fbd14a49aa61c4706a050cd2e14203bf9000000090168d49adcebea4fba6e1d14343ea5bd6a178ed6ec0f409814af7327a5af7a9c59f2db849ffad83b11ac720de03fb905d81d809a21119032e54d21f597de089fb0a4f12245849a385a479cdb12e8422aa9e8e67dcc617fd66ca9a7258ce0010253f877858f8276d99fa42d4bd0ff5a97672c2ea377d02a755bc41c5303675405fe8bdb5eacd686ba8698d3896e9ff6240000000bb5ce7567843aa78045b6e70109ea20ebe0824c5d958e1daacd9e7466fd649cb7169e8176d5fe37000c1e877417d6caaccd13bc16003f276dc94ce1daf72cdca	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50e12c967504db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432239932"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000000219ca434641617881ec8dce97aa251273644a1e842c65d239ce92ab8282b486000000000e8000000002000020000000957dfce4e6337e2709ae416bc78c2004660d8b0e33811ccd10d00eb9f277381c20000000fe575110776e54870e8192485be21a6a3e6fdf786dc300a6ce6655b7bb34bde4400000006a32850b02b14ad9e02a6b15820234dc194e1c7584ed699cd1d2cc63dec8ebd335be91702aaf90ed9872a325e279bf19ec9534917602f4faddb4ff0d04bbd5ca	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BD1991F1-7068-11EF-9C44-E61828AB23DD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2504	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2504	iexplore.exe
2504	iexplore.exe
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2128	2504	iexplore.exe	30
PID 2504 wrote to memory of 2128	2504	iexplore.exe	30
PID 2504 wrote to memory of 2128	2504	iexplore.exe	30
PID 2504 wrote to memory of 2128	2504	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\daef9d3d6fc28ca6c080a0cf6d07d107_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2504 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f1f7cb58ee2cd290b402a42d28c89e1

SHA1
57e94183cdcf4fa9393469d7619de018de8d5df6

SHA256
e41f55e23dd4d4d1b0da97c05a0ada9c265f7618560d9e85e28b3b0b84d70b52

SHA512
045b4d203e446347e4a0fe47227e3681bc27768ec2de7ea67d857d8604bce11090774e98fa66c61d146097c08ae2a6fbf496953efd3f790e787cceb1a4ea7103

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4f114e953a606d5924956b5c0c7ae3e

SHA1
d2b590ad334ea3acfffd4ac9caf074ea9d9f230d

SHA256
8f661fc917d874acbb942911ddd1bab02966d249ff695c278837aea36c3efb2e

SHA512
4650ef28914245b18644440b543a036cbd9ba12acd3a4c5d45ea4d9928572343873214a2a58e9341859c4fd005d18cd8d2cd8eeb90525aad1d2baec5a33fdd69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5f3d297a1955149595a6496c426a5723

SHA1
b37086e6361efc47baed75d3a5f1626f04ec85f5

SHA256
d7c10b786ed58630ebbcd93e6ad5fef69518a4e4572eb6dfa371a86c9627e4ce

SHA512
ea13da2a98905d9cf917493b03a4fe2cf1f7c82a053d95edac7b5c7e9a74e2c0381d65a4a650bdec6bcbf01ed206bb8ee3761898eb811de87ae4b01533b265a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9bb7128c0c9bccd9396041a2f24ea53

SHA1
ae7c7e7e56475ff1755745042a0e4aeeee1c4c54

SHA256
bce5b9eb24617d2641069e3770a381585775325b46a9c034f0b50ac211599a30

SHA512
4b2e58dbf5a3f1eaa42470e2c6f9bb6fa0e51deea1473721ba0e94bc4b1c601d9988ccecb207cef1c8edd459a881e0800832fc5bdfa7f6d1a95b39387f8c03d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f2d13b9f9ca08f743932a60567bffa8

SHA1
81ee066c8398ee116814216ab8b1124762cd057d

SHA256
6f3ab442841d766a823ab759334c1336296c99f3ac5aed0b4063bf28c382d58f

SHA512
011201f64a8fc1c6f56a0f3baca3a8f4dccd1b0e1afcb68a30b723fdbf4d60003d0ae84200250989278bdcdd4e43d3c7605be21a58ac997a40ea4e6beb876fd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
755c28f8672805d5d381c4f39a19f13f

SHA1
7a7f6e3c032d3ac9443deac155a879c7fa7d327d

SHA256
8984c24d221beb4a2f3ab995335e1d48f0361fb3ea06832b221c8916bc35446e

SHA512
ad975a1aaaf074405bde5eb0e3d5823223256103f87acd7a662aa6d5a0e1df50a6e0e5075d441834f917f0d16fe93560b80f516fe5853e722674b0c2396b5c3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2222b9faac08f2cf656d7dae1c2d3473

SHA1
aae85d3884e2e54b9044b066787e0d0b4fa67980

SHA256
28ce78b8d2ccd75b616db522c8a66986ed71964bcfb2320b9cfa87e183f04c62

SHA512
2f860a820fedcc53b834b83fb673a5f80ff51bd6b4adefcd2ce0cd2396296708f2c386a94b06f015e93fdda621e9852173d24aca1cd8a3fda50cf0df83906af0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
624985448ab3984b2d8fe1617006a4bd

SHA1
59673a369311ac7b9297c55412752a742fcc56bf

SHA256
22d743bff6e3c2c042eaf310e6909fcd1b5b4c1f701073dc7472683167936bbd

SHA512
af1d2c8c77955981cc1843a5aaea503fa3094d091a2e0597077ef4e2671c6c4f4fd0e3b5a309543fc39d266846210ec2e3f508cd146c206ce69ba75fb0454c3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de9c46eaae43c486ed247dba77435a85

SHA1
111ff1a12f203552f09b607907570f6a46706bf0

SHA256
6ab4a67facd0615df670f5fc0aef874959843231be8ebfa4e04e3b572b2fe64a

SHA512
dffe9e33884e9e4a1d11ca650f1f9e8a0fe91419628318c643407cda08b94160121ab2ff6fd1ac93b0633d6f9e1581c90141a52a5f3bc2ea50cb59ebfd127629

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a6da0649d59eefc4202c49d5270d86d

SHA1
d2cda24cc8a10d268821a0e9b9a95b56d37fd06c

SHA256
2cb0e05657143aaffa210f2db983115d46d66a0d2d274cdc3b3b674f2fb5b174

SHA512
ed2c6670c6913483d9191c9274ba5458be854d96d79688af4ae2f7f90d992d6477596d62e4b4933d99ede0016c3cfd6443c40e78f1e0900af700e3b922fc9e44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a876f45d3a446b029e3f5995998880d

SHA1
9efe245f525b39e96b4bf1ee066afe3462a52a31

SHA256
2ea40cdefcd7ad03191ba5000a2edd4d3a4a505f4ca61b42708a11864d9449c6

SHA512
b6febb884ac39e82c1103e4aebef5d64f4d4221f786a79711e2d8e227010c63698cc84f8ce7c898fd92dafcf6f66cc3a7c1f9422ef2abc70e11bef52dbeb9d9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c234ec0005ebcfd5ef918d9dc70e6017

SHA1
a84f688f527052894cc7ab6adb565ada4240e590

SHA256
3ee62bff5ec2dd671708ab82537691ef97db52678bc5c148c7cda6feffe47e86

SHA512
4b07cd1c0b6a95a20d0c35fcbbac4e76afacdca7b8a7823fb9a11c68643dc7bf9e01a9f9a84ac96ce82aa06e0355caba47bed6a82e92d162928cdb65ba57a19e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bfb328dae83f5cf5ec745390bb366e91

SHA1
2460d6abbe7932f0824375717f608ef7a2620640

SHA256
40e26a38df1faeeb76c7d9d6c243a35686e75f93ad21dc006b83728dc07b0adc

SHA512
baab8f3062490a43aa1705cf7d9cf3a6ee8384151a4095b490caa7a5eda433cf9d75a41b8c413801579f4f17d2ab3d896d27ba92977ee897d06e61cbc542a614

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD491.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD7E0.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit