bb07639bbcdf7c2a36eb6dbdbccf78b85d583f5a6e9689d341d6d62caad86b06

Analysis

max time kernel
134s
max time network
137s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/09/2024, 20:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

db318012dc3940933a5547aa4b9922f0_JaffaCakes118.html
Size

1KB
MD5

db318012dc3940933a5547aa4b9922f0
SHA1

fd1f0aeca515c4b03f0d656fd6e93f5a212c0c98
SHA256

bb07639bbcdf7c2a36eb6dbdbccf78b85d583f5a6e9689d341d6d62caad86b06
SHA512

da58f9b302e8dedd2f8cf2dc11ee3c7cf84fb08a34bfe692d1d1a7a0e8996a242afd76ce864ca1db1a6d37cc2884d57d284be70c70265237d9f735d627519130

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7A22EF11-707F-11EF-838F-D692ACB8436A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f035510000000002000000000010660000000100002000000020d01c6133d92ebedc5c7c24530f888784ee61e6452f55a8f6a6fc687e59cd79000000000e8000000002000020000000c6f7a1f5b10481786575deb1f42dca956899442d6343760772a84f90e8da52b59000000082da812bdf894e6b4794dbaec23500d8db77aaa9df2d88d3fba5ddda8f2f902a5b67bf3344769994bfe9f6815a3e3fd9012bbeecb27dcb118a495656226851b7f9ff2cb1f284041d0b83bcea7440a840f968a4e34be74e31bcc0d96e08322529b36e6869db639139de9c8058c6657e115b5ce0f81920033b4469fb8effbba3e8360d096a41e8a5047b3cd542ea4b5628400000003cc3607a06caf2b7e3eb3c83e25631900dd540c842829a4c43de1f1abcd8da7fb2d0a952ffcc6e964825abbeb8829a2dd5243329a0f7e4cf25328a5fd90a8e48	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d040095a8c04db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432249697"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000f51758fbe7c0c165549307c2f39540152030985b9ea086addddec244ee13f2ec000000000e8000000002000020000000ebf71bd2d73f94a297c77a7fb36fe295a7b0117379c747baf74412aac57673a820000000786462a534e0edfe4e232032967f1ee1381093fa2c11b562bab2a7024f9328c34000000042fb28fba219d57924d8ecede44aabbe77b91b1d507d7d475cc3f0cf76a38d4967ef3a02963b2a7e111554d5ef1e3960df81de13442b283f834ebe483cbc32c1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2056	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2056	iexplore.exe
2056	iexplore.exe
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE
3028	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 3028	2056	iexplore.exe	30
PID 2056 wrote to memory of 3028	2056	iexplore.exe	30
PID 2056 wrote to memory of 3028	2056	iexplore.exe	30
PID 2056 wrote to memory of 3028	2056	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\db318012dc3940933a5547aa4b9922f0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2056 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
86b0a51dd0b3bcd749e7c3e9cc1c127d

SHA1
097cc24bd4d3fb849c936b9003ff7c475b09279f

SHA256
dfe7d18444befa0874896951661b411c27ebfa42737ad6fcaa3bfbae0cdf940e

SHA512
69fffeec2960d036eee756a623111f53ad56b36ee4425c16edc0fa14ef4b6b7eff9096d1fd7a4e23bd41037814978e1a7a9690ef1e07902e7d28d56a835187c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd025045193edbc3cc66328718268e8b

SHA1
8dffd39b8f9d86dbe36536efdc8ce2a2acc6a123

SHA256
0686885f1aaa39725b6634cf85dbf4a823f2f1c7d8c4ece5b2c9f15fd229c528

SHA512
1cadf1586dab18b814ee4295867f10603903672fbf0097b727b5d91b3c7a0e94aac8280232f7ca08815c2757c2d3674e501f8f13c0d2367ee2eb622f884af7f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0f16bfa62f0b8bfac38a17227d3f194

SHA1
513ef435c8db0d56947a75aa106f44500a9415d9

SHA256
56ad7a10567a17403aac6a845b5e0232a58a625a4acf0c674a603c06f1eaaf01

SHA512
9b9c5dba265bc78c0b22e69a66479227ebe4a3bd2c0becb1f28fb635671782385cb5a575118efd11e30adb29855777f92594088af72a8bf84673ea08a9bb5b22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1080465a91688bd8fdd25a01cc878fbf

SHA1
e6de882d999bfe1c7a44bb081ff9e137335e2111

SHA256
a9f3e392af90d1645e3ce5b1cc425f90e785fdab2a82da09ef47c251e190f4fc

SHA512
0af9b1a861861e8d25f14b1090e4bd1ed51ca86129300338a697d7d85a72524090fc936bcfed4a60e4f2af43f8e0239c3e0cfda075dba9873f66d5c446ba1a5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d260f621e26ba56ac7a7d05c1175502

SHA1
8a7e62099965a486fe44a66f546b2923fa5e4bce

SHA256
3fba28d494c549819044902d82e0b5d7b4ac5ed61d5068f61d817be75c9e3c4d

SHA512
57dd8b0ede332841aa1c77110a897b9074f0deb8d6d241b1dd25f71858bb2358319fd6b375b6a26529afb22a289f511bf43e4ba193f1e3ace668136f3344cca3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8a73b6222652220a711c43527dd1d883

SHA1
306f34d9cca8c9ff9117a3e62a1f6a24a95212c0

SHA256
7ef6e456631e54d782f9804741b53aca1462f5d53e92d64148480724d9c223e1

SHA512
899674093a7c551c98692c10adf4b3209d8990de2e72e01200255b4cc90cbf3d24d3766edb85002ca2b74ea3a43bbee46d09b4f61926ee6370b79bf7017d50a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d7ffbed51bab08ae0f7d58e631c0e3f7

SHA1
458fbb981dade62b73e5cb0e5fe0caccecb8b261

SHA256
76f2b78a6f1b175d27698f8abc543b8f3fc4363272235b085dfb4afa21554691

SHA512
a8220eb43ace88b869a7b557ef5ff0f32813c0e0b15a3ed4c087ba3864ace1ccc5bbfe2e2c8d07bbef27a4fbc4b338edfd9e2c48d72d0b595276e132d701613a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1648312362fd1be0d83e19fbad11fa31

SHA1
c4ea061c8dc2aa347ae05f43b3bd9629bb80399f

SHA256
569d8e876886061d3e4bca33e0517ac21e4b42664261842118c38e8df2a4f680

SHA512
0387cac5b228d16c9bd1dc05853f5cf1e28434077b883e745a2e04c0c0883d6e6a0ff65031ea9d228dede61c787bd93ce6b2a9579aa84c2578d28f77cb02ab75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a9be59c767329a1667bec7cacc31100

SHA1
bb9da4b477cb18dc3b7704276548e8fd3db86b65

SHA256
e643f9178d8d1a1ad86a99c6ca1c041e051cd508026d32e46b3b800f480dacf7

SHA512
aa050c2dbe0bb586f1bc3ea6f3d10d1378ade35d06218565c3ed26e4bd12fb030dddf19a90bbe8623b1270ccdbc6498be32a04facbda84fba55290c72b1cea53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d05b8f9a3b54c047576af921b156ced

SHA1
2f0b3527b0f0a72d5c72a805a54c56298bb95d43

SHA256
5ea7d8839b0e77915b670f56baac43d612b6b50dd7bf708afadf531dfa6bc718

SHA512
08ad1f5e5921455cc039b0c0e0fa3ad3fc9293976168cf380ef2393f85902e3946c648f7d30502a039c6ee1d120b7e0bd060ce12673f723da53b94c980c21c94

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6cbbf4337a305acadbd6f903f24c916b

SHA1
3202b6edb0140ce292e02dba99863aa61787a520

SHA256
eff4981b1cc1a900c4f61703fc2df2787b80fd9091df8d44018339cf5259322a

SHA512
0ca9525e1137185bb7e68fbfbe66449539326d9234c150ef626a73afe089247e096d370c2d5f60d06d073d26075fbb026d53bdcf7a5ea464d74f109780c953bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
54fb3141186c3b1c73d07121afd7d4f1

SHA1
b2244de77b68fb763c9b6e176ff603e587fcd907

SHA256
3287532e8d39b3082738368c74ce694c9539ed0e41b05c9cb672515b13c07a4c

SHA512
6706996d1af4e858beb564667de37b4f02673ee73ca140e72bc961f2bc2c61aea2dea682f45e827d96964dc5fd52f3d2254754351b53441f1ecb2472019781dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB675.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB688.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit