cdf14ec5ccf72e8b82030e8a0296429487667fd517c5edf68cd8fef409071c8b

Analysis

max time kernel
132s
max time network
143s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
13-09-2024 15:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de71677ca47bcc054bfe068a7683c11f_JaffaCakes118.html
Size

204B
MD5

de71677ca47bcc054bfe068a7683c11f
SHA1

052a58d09319d842b4121f5c78d61e0490f3fe6e
SHA256

cdf14ec5ccf72e8b82030e8a0296429487667fd517c5edf68cd8fef409071c8b
SHA512

48f7a6c876065cb0e9fcf2bf78cbb46482bbfe9e06f505797780ee00f68f42c86e2cb3c76ed2466ef0e179d88e1681d93cd86acf474eeafcc3c6880c09c3d728

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F9225911-71E5-11EF-93F3-6E739D7B0BBB} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000993133ce587a5f9bd46e3adc7d44635538d87c1e6987df5c6e2603909b56c918000000000e80000000020000200000004f8f683c3ad00dca50b11f7db95a19aca40565929885eb6a3b6d0d2fee98482420000000ba972871fe36e0394066d5fca083a9b816d919916021c7de030c9e774151288b400000009ec14105d7b3eb6e7b510f823c2f9525b8785b637a7ab406b541451e0ad2f6156ca4a2bab2ab20c3e0ebd3175e1515234a7d236b9d4e94e9fb99dd7786e96efe	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0039ccdf205db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000af7d2eedd7edafb6631386ebec825b4f16ae83c5e5a92f5c3d83236f8e5662d4000000000e80000000020000200000002703d0034e2fd07a9a558aa6a7ed25a88da116dbaf1be21ed044b297f236c47790000000547b10e7c52ae77094d3a733c7eb3827d96f261ca2eb9c058fea493ea79c0cbf8ba7b4ae95822704dda8521496ac268eec97a8cd83553f93ea7bda7ae2ca367a2eb408bba42b447ddaece27072f105b87f596ac224fba77dd61770bb10065860b30569422fa3cbb47da74f9cabc3efa995be72535d432074085128e095805d253c6a552142a58ceb56ceb19fbdb63af040000000fa2896dda0a89b65194d9a34b8f3745013f34182c96e14cca9b42cfdc7c337abe7191936ec19fb71688637ca44c7fad57311224aed766ea5c976d99e3c2358a8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432403684"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3032	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3032	iexplore.exe
3032	iexplore.exe
1884	IEXPLORE.EXE
1884	IEXPLORE.EXE
1884	IEXPLORE.EXE
1884	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 1884	3032	iexplore.exe	31
PID 3032 wrote to memory of 1884	3032	iexplore.exe	31
PID 3032 wrote to memory of 1884	3032	iexplore.exe	31
PID 3032 wrote to memory of 1884	3032	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\de71677ca47bcc054bfe068a7683c11f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3032 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8435bba884f51d87c48e6e058ed44cbe

SHA1
089477b251dcb267942b36e16549e6d4103e87ac

SHA256
4925f8bef80b5e8432e27f027d51720cc2649e7524f72ecb87abe86a475bc507

SHA512
a6facf752bffaeb3427e5c09f7c0c9d2a7b8343eeadbbba8e8169beee707bdcea6d7a34d1c1c17371ca185dbe6da0487f57c1723a1759e147f4fcf13d0d962c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b14811c2c36ebfbaf7efe08f84934d59

SHA1
6fe2e59b7ec5f268002c2f8ecda3e00970e8ff46

SHA256
917aa5ff7484cfc6379e0a8e6e948be3260701a37a70c57e8bb63a20412ad28d

SHA512
6196d4188b850514c996688833d4a7689f9ddbbc2b5edd6630f44353824ce509ea74dbdd5b6e3aec8321307bbca7fee7fd8d06e7b206f22dc0251ea05ef0c274

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b04a03c5e4d6b18d7b1eccfdc336387

SHA1
df2d85ae479bfd2ab300ed1e42dc371d860623be

SHA256
49003cd13ed40ab0686bd4fa464ec01340a6f07153b9f0e45091cc55284035e0

SHA512
6dff9690ef56bcd2e73f8ad22c7042c2aef067d58c23e2740288af03970f5b5ccfecc67698f428d3c8ea742a68d74a55028acf5a1468b63638a5ef52a07d9fe6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d911be69789d51c0843383a9ba5a5ac

SHA1
255e7519889f57507d9e6dccea0f92205e95a5af

SHA256
e8d09e3350962eee239122fe280e9e53206f1904655dc4ac64cd45f5060deaf6

SHA512
6eca46174c6f8637c1fe419a4ede79dfe44cf1015d9a26770f169794eb62015c22c784b42b624ce4c7ed2f74e7fb3f7a3e6a360525a1f2dc1a44cb74d9704301

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1ffa8b748306b0cd4c052e45cd027d8

SHA1
8629cfc5d31b74e0a094d4c8910dac28edff00f7

SHA256
fc3713d95eda3b4b122d74d2771148b353a8c564675c7ccd14d0f03fea2f9271

SHA512
45a5f0d02f318bb3574e7307c50e1e216ed8a2ac3555aedbe65c11070528b440e9ce6db48b589ad611d081c2056773f6174803c07c2d9b2abeb46534377e257f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d9f4c4727998d5fb4cf7c42399baa42

SHA1
19cb167e7521355b7f16383e2179188f6ced5fa6

SHA256
6f6cfc1ae4d84aaecc9d036a7413285f4106e47cc15a0b6f47904fdfeae39462

SHA512
f94a132d3fc4a8714f994f144c9ae9d686ceda32c77c3038305f5e416a65135390bab424bca6fb9399714afdca11b838c69bd29f72206fc7360d24b45f46c8b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30290a3f1cce01d64e87f1c951407ba3

SHA1
1f630a125c35d6625d2900b2555c74533858d0a8

SHA256
6a078bc309d09bd6ef7418a11ee51413c218269f483ea64d643634e2d91da88e

SHA512
705c814eed00507726b06c25ca6735930577058ba89c82eadb56d1f0cfbe8140193e6c6e90fa59376080b407e6d9295b1a43e44848c555e115c7ce9562dc038c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0b03f7f1cf036399e2a89a67451330a

SHA1
0f4e3b7b6781175390c50022e4be6f0f709be7da

SHA256
17116b03576b53cdc4af32630c376d97be03ecfeb1a6750547ee4a9867d904fe

SHA512
e32a1617bae73fab967abc6a84cdde1b9b230f7a1437192399e63cbef6e317d10bda9649826fd74e9b7e9fbd664dff5a93201a100773450e40ef1d31b69f9a62

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5520ed5668deb134c480ec336c7941ec

SHA1
0481845ba3dcb775a511dc0b0ff15302257c6f50

SHA256
5177dd1d3fd1c34ad14ef0a12e53b5a576bd47c5a8e5c2e1fef4018aa4c5c223

SHA512
906bcadb9195e6e16892752b65ca1da10d26d2bb3226d48444c7f6ec200ec23fb54f1a4571b7f0b5bfad1a2f2e40e8b7838eed679150e0f529f2b54d99327eda

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7951b3d711fa861a4467ca08146dca36

SHA1
e09090aa61956dd8e2ea442067b741eabaa63a77

SHA256
9b5aff28b1a926920e5b5ca0a2b1f0c36ea03d736932dafea6fdcee9ba0480f5

SHA512
809686cf9878c4a2512becab094c45241cf241a90f927791b3da33a183541d7b326e61a5ff1d760d11153748eaad7f0910d812b35c8083eaa872f684670779e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1abebcf2ffe9b5f55baeaa6df5d6b6b3

SHA1
522e1241ba2ae19e69d275b494dca3b76ecea929

SHA256
6194fd0d6e15fdf065b0d9057c58cc003d29b88f89f6fa6cc0fcda67f43ed745

SHA512
32288cc830ad85bd78e16ac40ddf1770d138123e83632cbb5caee7756fe82dcaa8026e1fdf089601bcc00c6c6d9fdf9e8361535b34d97278db382e94df90a746

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF173.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF1E4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit