45b0efd1aaddc3015ce54723bd309beeed5455218d81354f205188581e222705

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
12-09-2024 14:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dc67f44ab3722b5ce403ca1a8bc93725_JaffaCakes118.html
Size

397B
MD5

dc67f44ab3722b5ce403ca1a8bc93725
SHA1

104c8c725f73529e32e4ff46bad901ee4c8eb6a1
SHA256

45b0efd1aaddc3015ce54723bd309beeed5455218d81354f205188581e222705
SHA512

952a6010f2e8c11a82034668000c33452aebd1a50b8b204208bd48b648521745ef563c6a0c8eaafe4686a6aef8f0056081b86d37c2e7ce5b97cc3db80cee4e6b

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f542000000000200000000001066000000010000200000000b3168a6cac7571232259bab53248a692a2756bd3e6ab801902f9e432f6dbf75000000000e800000000200002000000040d83437baf3067d511c7213fb091f87e61a01fc8677b963a43be10f6f1a3213200000004f795852cccbb49c8486b29424b5682ba28371cf612d6b641e7990f17a57202d400000001fe5a4a79d7078d572d88c1729c75cd990972491ef443793de0590f2890cf4d3e012188ef4bed0117ded20c5c6c3a7d75638c086e067dd8819b743f494802fd4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3D453B01-7112-11EF-BB31-7694D31B45CA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000078a0cc6b0b830b4fbbc12dd3fac6f542000000000200000000001066000000010000200000006ea98ffb6a1daa8f8cb16a9063b3043a524f43d8c02f99e76fdf3e41cc3bced2000000000e8000000002000020000000a111085bf4797800c9f8d86d7707dc5cd836f500676d5b22d6f51e1cc36dd8a790000000181c06e07c9d24d81b1847c061389c82d482c542656e500d004db8d9899f034548a4d9b52e002db7dcdef63c0daed652819a6efb4bc96f8e2e71e9e2f048ef226f7d7c34cd538f189367faeb8594cf6c337f9a2ff30874511dbef78535cbc328b178f5ed3e61e34581b8c214a06f2a92cbe45ee295529b3181b4c60aa1aa6ce0be63b5afd385f331b4da891b9cf219cc400000001c5b8b6adbc5de8e1f8653064f2900406ed6f7fcb3177c70998ea8bddf51c4f18bc911ebdfe90a6d10ad59960daf69393f7c2940e45687c9bf48c734b93ad0f9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20decb111f05db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432312730"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1800	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1800	iexplore.exe
1800	iexplore.exe
1544	IEXPLORE.EXE
1544	IEXPLORE.EXE
1544	IEXPLORE.EXE
1544	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 1544	1800	iexplore.exe	31
PID 1800 wrote to memory of 1544	1800	iexplore.exe	31
PID 1800 wrote to memory of 1544	1800	iexplore.exe	31
PID 1800 wrote to memory of 1544	1800	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\dc67f44ab3722b5ce403ca1a8bc93725_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1800 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a603817842f8059358af6744d65ea2dd

SHA1
8d84713768de081c87951b2382221efd042cdb1e

SHA256
1f490291c250046958b197f33a66180fdf9384208e3f25702038f540cb15b31b

SHA512
19f96e21986f5965f2afafde5ba16b5074be096ada8ca13ae2439a6e1114a9cbe2dd38ff99ab5a7eff75150c5323d67e20c4c3816243e782216e92aa4cc88552

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1128112cc66e29ed320e0fc651b83a4f

SHA1
c147884f66b1975d196d9183a5a6b19f25847ba9

SHA256
3a48823cfce1b9701182fdccbf3bb91e8a3aa70c585032fcc4e6c1beab78ac91

SHA512
0be051ac159a6cad6946e93a79f8f8e1b60dcf0dfc8840fea66e7645c7a78a5fd2d70e30a8e4a207b96f0f9526003e80e30607d797c8c3100a756af03557c82a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1eb366cfd27b87ce6a3c937ef12f0534

SHA1
8637a1efd9d5f9d31724127abe7ad12b6ad3eccd

SHA256
129450ba5d19149002d3de2c3d9732ca2a21c7f4cf5c9dd43c4ea7c1b82a9c71

SHA512
8ce685d0d6d31102f53dfe9b91f4bb9e5b90be7495529ff07c021c6ed8a1bda0f9f12341ee163b0be4674ddd80f26104cb8dea8da84e2b3470a1e2f3f2a5d14f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8ec401cc08c7cccd0184ab5453fbd63

SHA1
56e195587b8fc818ff40da1e4065a543746c818d

SHA256
4008ac9c9d91af1d6d8d624a03d00492ed6e863422f895ed5ae08ea21eb19d8b

SHA512
5555aa92cc90a25fbbbbee3e766d0d74effc6fd766ec4de8e9916601ad5ea1f43bab46bc90a21fb9e8739c7b13d1ace5fc730a9252fd255c64cebdac540debe8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
251ca5b704fd3934443e2f4b0224a804

SHA1
1976ca21eef4c6e666a1a0eff6e17f5d90c11ed9

SHA256
70bafdc55be7470f7ceeb98f6ca8f5b9da0f777e3ebdc4558b64fe7307ddecc8

SHA512
acd4f85940dd28acd5ae0c8aa6f9014445414d84f8b9f473c677e2aa2f60f8b893c912234586536163d13cfd867356738aba97af97f49498bcc58079d048c1d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
804744f5ec238b6196f17ad5363deb21

SHA1
19ec1509fc001c7d1b4c8ad22230666b04599153

SHA256
90703504a84146d2a18d6c4efcb6624312a9b1db77cafb9449105f8439975286

SHA512
a03841a5aa206b06a61bb8dea9b7713e6e4c066313b739ab7c616ae90b21d08be8fd8726616e8bed1b26babcdbd9e1f75f212163d198b64b06da09b05fe3cfc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d54a27c790ac3dd74bcd6fb07906770

SHA1
65e30a8038d09533b1416919ea20cfbda1a2d2db

SHA256
d9fdf4c5ba9560fea419713d1f8208868c2b6f103639f16235b38553ffe45dfe

SHA512
2cfd73bfd1ef7746feb2b189f490f691b78a0a28febabfdeb63761747df537ea62452fa8974b75f8f8b3fef13189a10f0f478e67529cad59426477e7c617835c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7be3c1542d8bd3438b467dfb60074c9b

SHA1
f7db02a6d79af5b655909824cc48f93d0618f9ec

SHA256
759c28df67f9b1f0d581ff4f8fb866253416c567a239c0e7bc30d00237409065

SHA512
429946255adfda81b0d500ac6e935e67012b6e27005b583c5c4cd63d979458737981864ad7c970e35cb4c3954a1793714688f90b922ab7cde00a6194db503c7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4bdfbfe63f7d73662659bdca7d3744ff

SHA1
77c26963ad25f4aaa9d7e2c817853219345cbd51

SHA256
a6f1a88ac0fc830a55c1be038caf23007a36a2893d3e5b09ef5bc2917a7b09fe

SHA512
c286e9ceec7d9d35f3368b636025036fb392411c3385f6b2b21647d1c96b56dbb97637c4c1befe5d52d195ec31f91fc7d26389f45f3c2ff278c0b6d0e6a50a50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
faa2460570b5fcfc515783ca1d887024

SHA1
5014f2b4c6974f91fd741d63706761c204bb7d94

SHA256
a7b30b88e735af75e2368ca91758a34d35873502036da89e95e129322e0edf53

SHA512
f7ed21b1e91e38ccd8f505791782ec95cee5aade9dd9663fa72089fe2bb952927dedc0548a75ad081b780dd953c0343f887272a16ddfd088742126db5ca55e53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
533bf6dade8fc6de1abbdfdc59291ef5

SHA1
608763014a00048e3be441da711140b36c74c124

SHA256
1a70967eeea24724fb4400fc1256ba2dd816c0c42893fffe970f620a5d0cd22e

SHA512
99c173d9a9bc3d06c4b05e8af2e25f86534000917cb1dfd8ed6b2f28f56222ff4f707e0b823a42002bfffd2060a803d7d013f83df2ab22467e0c31d6c158f390

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6527031e4c47a9a15bbec0568e465c5c

SHA1
12926292314815f600050243c0a1f506f013271b

SHA256
41815c36a551122736cea13d6d1c970a891d2438a8764e753c6656908b3610f5

SHA512
dcdc4f296699dfba0624925963dfa0b7d4bfa66c5101a89cb231f756138172eb1cd0eeb85962d9fd0465bd091a7bfa9604f52c4434f4519064bf447342e2998d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f01d0dcc68381a3aa24a9439ca06b3c

SHA1
eb9b7e403cab6f15cd9dc76656ce860a4f1e968d

SHA256
458d477afd7fe4dc78a44837d4d051d32cb628506b7f4ba4457997d6f7e1d240

SHA512
0f192f76f4348b97eec0c0d46693e88e77247b85f7fb4ba5854826c8a5559e7ead468e3a8f7856179061dd80020a7ab0007de4a3515f5f683394f7a66ab08def

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a012ab070ee484913705a9025baf46b2

SHA1
6fa6da3f42158c15ed9d5314f31bc0048c5faa41

SHA256
8d5cf243d7efa4a613efdbc4491c1ff71ff197fdc055fdeeda1e5430363b3ade

SHA512
adbde9b3245e4042415a35687da47c3a489c57ad11cabbe97f2be5134af7a518b9670e859aa54e89e632fc0b45bcae606adaf272f6f860801043b7404c4766c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06f6ab37490ec63e9767902f0116c574

SHA1
3d38f4dd4a319128ec05aecd4616002549a1e8a9

SHA256
a2b78c684e6d76f165c8cb0801bd070fbcd4629b1e6e864121307c770460af52

SHA512
7319349ab8008cdafb6ea5b642fd38124b5c5d1113bd1b3378c49da9b63556e54071b3e62479af171b63e92972992bde7b35790415e6151e0010d927bd534b37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e324e5c775a61051e0360e1b7ad2d7f0

SHA1
f2fc75e121f1299c34311664a7a5eb8c40800f18

SHA256
02a58d0bb5e3f21f7c34fb1d8fd0130f36bb03f6961c06f7b76db89923e21a00

SHA512
75d4104339a816e23fa9496d73c5604bdff0606d7a9e0a4de007bb6424fab874501142f2eb52229aa1b41c7e49024f69f6585a197fa9fe48ba4ea004bc6f6305

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF7BA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF82A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit