131d494f96495c57f378b21cbac8d8804fbddf7a2972d8114b926cafc9eb705e

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14-09-2024 13:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e051277471558706867a16e63c130549_JaffaCakes118.html
Size

490B
MD5

e051277471558706867a16e63c130549
SHA1

5c4cf92cdcfb1463dd500c10d9e07970e0d92e3b
SHA256

131d494f96495c57f378b21cbac8d8804fbddf7a2972d8114b926cafc9eb705e
SHA512

6fa2301024a161f4420113ab191818381bf62e3ef3475980e6d8c265fbef0a2d4ccffa60cf8e3cfce988ae68f877498cc57429ca30652d04f62ac0f36b84f8a2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000111cfaadd390ca99fbdc84ee1bd9fe7d6abc2bab271823bd4696300cb567c51a000000000e80000000020000200000007f497259333755b478ab81ff98d9f369779704a6040c8120c778a6d51b76a859200000007d80268ea92e9b89d132326f9e4899b4ceac65990317f756c462870bb4217a4a40000000809c3afebbc11e8e9af1f98e92d7a6f746dae3a21563e323cce453fe6811d28f48ba41ecc4f93b4bf1cce969ed90453c3471fedfe442a1d632838659bc2cbe0a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10246d37ad06db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000eb9cfe2486898b8477b5e8c6855ed8b58cac5717ac2250786debc89e09169e74000000000e80000000020000200000009d042cd26571454dbb51e26bf683ff5a4b3a3f74c7dd668f9d78c8a4881bb04390000000e87265c94c3eb16b230b1d220022e2fb179fcd074b87d2598736492d6e0d1214ba1d895c33b568cb4238c88a79279dd16f009e5c620fc192511d048583d8be5e2d91fe8f17c580302776014d687d274050462354d2ad95ba38fede8a7054ceb87127d3c2f916199d461aaf0f20609ac9de540b9e2018f80b9b008f951aabed16c1fd89ce0bdd8f23b03638a0e0d8b9bc40000000238d039109b2b13ebbd8536b7ebbfe8fc716b1d095521ede64fc695803ff0ec7e3e6fb440409a55ef06e980d6334dd3545671b553ff3177816128f1058430045	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6303ADB1-72A0-11EF-8DAE-C28ADB222BBA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432483732"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2660	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2660	iexplore.exe
2660	iexplore.exe
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2680	2660	iexplore.exe	30
PID 2660 wrote to memory of 2680	2660	iexplore.exe	30
PID 2660 wrote to memory of 2680	2660	iexplore.exe	30
PID 2660 wrote to memory of 2680	2660	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e051277471558706867a16e63c130549_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2660 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e614493e6620b0e9a790c35c976879b9

SHA1
771113b68fbe46a61442c7301e4c86de9c5c8c1c

SHA256
db05e28c7e4d6bba478c0cad804b46928c36f15e27831cb08d121336894b7994

SHA512
4a8b99930385f0ae5de02a5df2df7d1303f1e9663e882678e3b960b1f2b09999eca6cad7d42217ae8b2357432bbaf879b8b5c9067fa721d921797a930e2f3901

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52ba16a1f79a2ad94121e053586b877d

SHA1
55ca2de0d6288fbcb395245507364ceb9366189e

SHA256
6b9c8cde84b3b095cd7cd9bca2b2f15dfab62dcb7c4a11dbf898caea1c976faa

SHA512
2dbb7fe40e36b0bb4e888df7499d39b90f92785eb3766a1b0b918d6fc9e02a5b2d1436af2d70aff343af5261a105ec8fb546864dfb61fea92fd0219d47a99d17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba811717c56112a78a696c829e9fcee5

SHA1
e8bf761a148a93ecb21191caebb22e71659efb8e

SHA256
375fa5abe3840551ae340585eac6830e3fab789f98cf5d55a4375abeb8b5d918

SHA512
f02c68b14ff1bb4cb108eebc3fdba18b90d6daccdbb184212f200aa9f21f3d94e7b8ff8332d0f7e5238ab68a1c17163a21cf7897edd584755632040ed39bfa63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5574ccb12dec6dde8f2879d6baad19de

SHA1
03cc12ce8341655668ecfa00ba13f52ecc6d577d

SHA256
391b31fe3a9d3aadcb533a9e85b5311aa3fc983e3537e3497609377a97d589ae

SHA512
6e7d70fd64a45e2c705a7e79fcee17088847ca7b25c77374bc63982d314574c5e040e4a4c5f3bca58e30034db1f3ccf5d412da5836d6cf38d3461a6bd80ea80f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
790728b344cdc13a9c8b34407206315b

SHA1
29697abca450bd8947666ce0b0f6287e883b2631

SHA256
8e9705f4a2a7916fdca12cd3c4d9bcfd72fcdafbc7337d0d4954ff5b0ddf4de1

SHA512
d0dde6e58ebc49184b5083cc6709f2604798e098d651365780fb1f486fbdcfdfbfad5fab6db8046cb668ff0f289b378af6c052f4e2ca91de31865edb1432ae6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbbe3547a2b31605820e5a9be76eb9b5

SHA1
e53d2ffda673e70100dda6c6309bd8e508e4f2ec

SHA256
76748eefe0847d7cbad9c61a5600e5d30fd555067f7fd2a2a95d223859fd6546

SHA512
e0b9390fbe3a8452b8e392e84a8131f980f2438fabc66de90a4b09fd9ae63fc13630f091ddc5079a27e942e790bffc10e418e8e0cf0abe6a74e48319eb5b2f28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e4088182720ace770a960d47c6023c9

SHA1
27ec9cc8f31d3fa7f15f00579ad0a01f5e52a47f

SHA256
f7ee3659e427c080e9be8da5923274d7e3559860634e348b48dc3753f46adf44

SHA512
9a8fad08909439db6f94d2050f6d6d6ed62223124419396dc6c60db48116ad39f873f536beaa10105289b5e1155a82da5dd677e14d12b8ccc3d0ffa9107035e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1764fa60ddfe363ba27bee32e635ce84

SHA1
8f0b017ece1091ec25d1d501041bca8ebf5c559d

SHA256
898ead039595c050e7b6c3c040fffc584034670ca019b18a1d87a870c5c216dc

SHA512
4f63832425cb0eb2099a3d26fe5e38c3cdd5c53fad8de3aaa796a1898a1c5f56e99ab29bc127cf9179980b8474b99442673409888c3e719889616e6a628bf216

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a22e6bf4f808eef35bcebd56c02828b

SHA1
b7f659bccec704d4c0a99698458c8627b8729e37

SHA256
193cf4315416586df79583c1c83c5db810cbb9e0f095ce63668becbf6403a27b

SHA512
de76961a7562b5fcf5098a7004adaa64363ba0555578db15293a0d4da97c55fee8e86206d782c64e7832d2f725cfee90ef936d5cfb911e7e03f4ac21a54cdcd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2a6dd792be213d7f1e3e56f66136aa0

SHA1
a4cd26bb658f8242aed60b4807cfa15cd4c2a7be

SHA256
0bb25867216a36e567f97c6e3cc5488a8b5b2741bbb3ce7fcc0b9bc1308e5795

SHA512
2703858c0118b51e0806fe0a2a91e65c2b7b6d68ef0988c8385e0a01ed38b4fe03f0f4d59fcab16561fd34df646e17e028e10455b940d0a93fccf818701d49f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09eadf9f0662430a8b8829077bb4d176

SHA1
4a3f9f57cc668c5e71faa2377c360c1fac73fb34

SHA256
27356acec1d475806618732149054ce081bc5fc2f59fa98525665fee144a58bb

SHA512
28781bb42192d3169cd850987e0bb84e9aae1617afa51317ac741110a891d955ae6cefdeee1f3c0fafaf559da07c49bb78ff839e403cb12e8db0aec2d1415a00

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6165.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar61D5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit