4f326214109b1f6258866952836b1dbaaaae1d973bc3761108d044d7e465e54c

Analysis

max time kernel
143s
max time network
152s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-09-2024 20:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db1f84450afb2646c60a094316372f4f_JaffaCakes118.html
Size

3KB
MD5

db1f84450afb2646c60a094316372f4f
SHA1

f603a715c8a2b93dda20bb5200d83d388d984492
SHA256

4f326214109b1f6258866952836b1dbaaaae1d973bc3761108d044d7e465e54c
SHA512

cb1bfad0c9898654c1b8a6fece7ff2ec9130d0e8371b07af8400e1ca6f7a3a49cf922b307590eabe0e6a62c17ab0c7139a6af2a6b0c4a975b3f3c03ef838c64b

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{89D89651-7078-11EF-AE16-46BBF83CD43C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b0000000002000000000010660000000100002000000013b032537b4538fa87ee87f0506dee3ed57ec3608de0243b92b543585a12a4ad000000000e80000000020000200000002b837783fb8ed1af8ca185e85c3665eb74271d15fb9897151cab1585c6fdd50690000000bcc6592d4ea631680c93c2a13a81f5b5ea763994acf2096dc5dd10b4d82e0802128e176022f1632637615ebce822f99457b1adce80b0162b0002da350ebae987f2897aa4604ba3e36eac574c695c07bf2146b26c1ebf146cb867e491657c9034f602dd92b0aed046eb70afa60addab20b994e7283640828cfce4e40ac9cf8eb4a230a4a5daf491cb0832f43dca2bb17240000000010659276d4db5d67690d385254e5d287c4ee353b0ddef5b812b413fb7b4d7c3b577b2fe78abe585a79dbaf3bd1c5e46dd30f51f390dd876281bbbee77f5a39b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20953e5f8504db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000ecef133da58e73a02fd624cde7d940e6c77e4b8ab2079cd0904d25b592522365000000000e800000000200002000000071d245cd951c54c832c4c0176f8b616cf4f6c9d249c9ed605ff16d244b1e96be20000000e6a6d7c479654c8262fdfd8db246fa28def9cda3eecd0392851673b00d11ffbd40000000d9624581212048d96e0fabf6eff6311af300d06c5c2cdcddc3e40a6eb3d652e09159b7f1beb3e61edffd00d998b701d0d535660cae1bb64397a575ac315a06d4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432246724"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2808	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2808	iexplore.exe
2808	iexplore.exe
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE
2824	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 2824	2808	iexplore.exe	30
PID 2808 wrote to memory of 2824	2808	iexplore.exe	30
PID 2808 wrote to memory of 2824	2808	iexplore.exe	30
PID 2808 wrote to memory of 2824	2808	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\db1f84450afb2646c60a094316372f4f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2808 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d8ca59419685d9ef7493de134cef5b56

SHA1
cefcba65c8d5bb97955eb81c0d7308485671f7e7

SHA256
878154d45cc59252fe4398bed7c1ba2ab4a305693742f987e69592d855fffb70

SHA512
69213ea5e7321aa6f34f65d18c9394c6556003fd2191b6da9568b7325bb46df2b0631a2bb4ce4ad626947ed9c8b10e7e875a068653a0c23b6518ac82cd24fbb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ccb3348305ae6f80868120345db1b735

SHA1
0caad5c083b0198be22fc2dbba738a4086738c9d

SHA256
da6f1bf829478b50a000e88740c0fd6d357b79bfe574fceb2ce18d6f4d9d321f

SHA512
34779d16f580f4e859ad560ab2e2b11bad85509c4fb3ad2e5b2d18bf4d725234c4decd0be976ddad60273c317d6e61b16d2ab9880ad87cf033e0dc03a0a99e19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39d8c21d75c5ccc4023f024085a6f9c1

SHA1
2f0418d08613a89eb215b3849b6b4a78c7537775

SHA256
ded6a7f259a134b7dd4e3e8673db9001b0e68a15dc5068e23c9ba1f41f347012

SHA512
794f6396dc23e7143e5095120e90e276fe8c099524e314e323a88f6a8f3b92085f4612fe06f0acc981c49be76f5a5fa8f1a6ec4bbb3d3657c79d4cc29ebb1f6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4dabf791b95d7cf979e3baf79ade6a2a

SHA1
96dd7e794c736bd981c5dd6c623161ea4622b48f

SHA256
ea016beea4ca9d0a6b2d4a2fdc0fa4d6e5f042ceb2b7fbf8baf71574c5a6fcbd

SHA512
5028b966ecd205090a5b65184e2850882543f67e7c3b1042426f6a1e7099f8245d28ec557c7936f156ef78be7a6912dc02317023d35d5dec85b7e881ad28045f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dfe36b68e81fb89f4ba1c081290d4e8c

SHA1
7cc9a9f7fd9b9aeabbd0c423c41a67bbdb31177d

SHA256
c5cee9b48afea69d1545a4a8129ec9781c0f2c719e226f74ae79a343c00770b7

SHA512
309c30f8db7dc81072904d6a4cc1f7c5db56464909658a965d68173949b89732ea439bda235b509c96b3fed3c5b7ae7945bfd6514dc3187255dd38d8831c48c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0deee5afed594f506961f873d0e9c8ea

SHA1
d0a392fa7deb3e743c3c743911dbbd25cb652251

SHA256
8336e2bcf1140dc610043cfb5a3a3b9b5d14b816da5f40af91ac3e174c5033f6

SHA512
031f12ea323d0c70ba3732a0fd519abefa7ab115eeec268ef650a0a1e61da97f6e347935a127bd14e3de2a38c4ab96a17f367236cb2ad828c9b592f3f95b56be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0acccef573acc4bdf4759543ec18b07

SHA1
76381f9b8b8e99bf7440d5f9149aad355f4fe877

SHA256
50671d712cb4a5914183085b4235a85ec5289c3b9f47600d311273a0a4708ef4

SHA512
7c088cc4598d45aa0d320f0116b632e76f3c5966ed9a5112a88af2c8bea3a69fcdaa6c04fdce620202b338a5d0c8c80c9c565893bbc048e910837d246edabda8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2fa65c961ff44f445d2c49f3d13dfc85

SHA1
ab27c8eee32a3b4d0728cd32aa2ef0b3c5e52496

SHA256
eb370651b3fc5dd14895c4005ea53c1ffb802fadc30cad9c9e6aeff00816bdaf

SHA512
425452e4f1a9de85146b69c31e0a29e610cd9e9ec74bb36d91af2a7a379af2a92559d93b386c81770516ca8296d9a54a07b662b6d389512f5dc662f7fc40aa18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97e535d35a8d03030d3e6ed68ee3f44a

SHA1
6799b820fc79d33b28f9f8e6748f5fb39f8c2595

SHA256
573971d9899fa643ec50449c1462a7bf80767572ba2ad6d95310a0c986c7aaaa

SHA512
0b3eb271cd0c93a4a6cdb78c71934da74f333d50ce243d3283844e3770857925adbb29ebaa236d012f8469c43534291c59a85c9c69bbe43e472d53338ffbdc4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ffd711d887b8deec1397ef46dd09ba04

SHA1
239ea7cfe0b8889ce4bd1fe8add86fa2d075d8fc

SHA256
038d4cc17707d19815f34b9a3c48f7713faca09d5111263f649464235ea7d392

SHA512
091ead7090dfd2e1cfb2d9ceea5a8c2aecea57622543df536380b086bd779c3dda18010e3464e84dd857ad4a1d5f724bfcb4c9f50188de7cf0bdd9f8d5e90d45

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7BA6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7C78.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit