4366521d0be20203f7b4ff897a95c4366ff041b33826f02ee1b0a5f8fbe012d2

Analysis

max time kernel
135s
max time network
133s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/09/2024, 14:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

e055ba70851e36f67528fefee9c12211_JaffaCakes118.html
Size

2KB
MD5

e055ba70851e36f67528fefee9c12211
SHA1

dc67060b47fc90062cd5232c10db60f4c0dbd28c
SHA256

4366521d0be20203f7b4ff897a95c4366ff041b33826f02ee1b0a5f8fbe012d2
SHA512

9b3957d93748e337868516dc7df71d02e8a83a239aca1ca060d0ddeea526c402ca3bbcc8d05cde20f0fbdee1873550bb1c94c6145edd12d8749434f81abeeb71

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432484383"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d019ddbaae06db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E60A2B71-72A1-11EF-9E99-E699F793024F} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000ee02452d64142489bf45a57f6f54c0a7ec630bfa9c5dadcf6d3297b256a41e19000000000e800000000200002000000051d5b0324346ec0fe0b1aca15ce9a0b1f33b55700d87e309756e0ecb9f6b948390000000202fe5330312322c8345abc0dd0318841e39f4844de500b50f49371ca4cf8dd241528f0a72857ac2886347529e561cc4571043d568325e0065fdb1110ac7227a4d690fee0d2901f0759aac573e18048d01e77f639267a9ad89be5c46fa9750a2ff4f66b7731801e3883be162fd090a4e0a8ea13e53fa1a57dd92f93e2077ed36d57d1cc154b191f6abaf7db04273de3a400000008c79a06fc0463137686216341da864d5a14aec67345aa6c4b84cfdacbd935bab1983698d125dc7d57684bdc61ffec25f2562f517186faa218f09267bb9988e7f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b0000000002000000000010660000000100002000000071ed26423da65b502d44f5ef6559417de492b571536d48915985f3cc9945822b000000000e80000000020000200000004acbd628211ed50e74910b1794ce07eb7b39ef888c4d5d54d59a13d7db79774e20000000a6afca1e99aab4a34d7e4200b147cf4ba387a0d87c2b8ea7cc058d24a6141124400000006c69e5f7e7943379f40f81d88955f1de57fa110ab076a5bcc5157e6d391dedba869459b8366ce0502a2155484ba9556956aaaa036cc6b5a0ec41390249db7772	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2068	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2068	iexplore.exe
2068	iexplore.exe
2852	IEXPLORE.EXE
2852	IEXPLORE.EXE
2852	IEXPLORE.EXE
2852	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2852	2068	iexplore.exe	29
PID 2068 wrote to memory of 2852	2068	iexplore.exe	29
PID 2068 wrote to memory of 2852	2068	iexplore.exe	29
PID 2068 wrote to memory of 2852	2068	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\e055ba70851e36f67528fefee9c12211_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2068 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2cfdca412b4fa5f08fe3576529ee84e

SHA1
43ea0b84c8998ecea3fb2fe8d5bcb169ca81977a

SHA256
e3ab5911ad34c32df8cf19b14a13dfe9e2339284f384f366677ef435abf04def

SHA512
2d79bbc7a485686f32e00f11d192fab7cb21735f37330f4b8587a68cbfaba419ebf7412d5de2047ebd69fdcfb38aacc9c29f289d414723ad7154de9cc75afdea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
251405f3977c3f14ba0acc4aedcaffde

SHA1
3eb84e3a9ae8ef2860d61cc0968552a75cadde94

SHA256
3770b0bcd9534958632e6685cc1f5ae916450bdc4d1f387636ebf94f415926ba

SHA512
72b25244eb8233e27c6d2284c22e07e37bcebc019175d8d2141584fc5e2e94ee23473ea8a42385092803ea703009284e99d6d1cabab4cb840b001d8e85ca06d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8e6e72217ee2945c3f3905ac32e5795

SHA1
c49a1fd749cee4baddf51ba930faa8101831557b

SHA256
e20756f7436cae94b19ad93d4091dbd7828688cd549b9a0a2fdd674859826084

SHA512
f5fdd2d4a96d26825a1067c2204ec0452ce9ae3ac873da0fca7089d2504449b142dcc7c56a63716c449dd1ea06c2f3605d3d4a8d37e8bb212d4ee33ef6f7d138

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb934d2219eeacf3b2e1c83786540fb3

SHA1
02f6dca97f6b9fa9c5992e9efb448f2bc23a449a

SHA256
2ebf2e1338cbe179e8e47003a684aab92fef394cc68ae1bfc937d81b60229959

SHA512
61a1d0fa010a890969ba5ed941cbfcbccdea410759345c23af402254c08574530b78143873b0cd325921dd4d8dc0c1aa2bec4b50c37bcc0d621c97b1c6174d48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b144f79e4feacbd1fd48e42df62713a

SHA1
273e230913d626802a644bbbdfb236b261050ce7

SHA256
fcdebda3ce1b5cbdd345a150f8f96f64c5e9276b42ba031e011df04d23b85576

SHA512
18e2659bb3cf75c3a07769a6e3ccfbcacb67f443876c2bb169a238e7710e87613a398b5077407e0dc1669a21e4c1ab46544e03771fa6e1a95b4793d374097aff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80b805f6d63e93ba1966a3fa9ef91fae

SHA1
c65461b7832559d3f465fb58741900d0d1f2f6bf

SHA256
f0c9ed4d1c410164db6e129f1cf6b92be7130605fb28229fa79a53743e8a9c01

SHA512
74e463c809aa6bc5bad615cb09775ac40eb6a18a12f76edd9186e2b30d1f5a6e72ae6ada0ed9e0f9f3c33af68fa4a55d075761dc1a956d977f6c7061790ef197

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4324bd27edc9868d5a4b044fa6467ca

SHA1
c09da9e04ea3418e613a71d0130233003e829024

SHA256
16899d87008983ee4d519345d84d949a3bd99632d580431814fee9934cccff0f

SHA512
ae49a824173e369dd7bcb4e5324a56efec4784db1bfd59314fbdfb8f6ea71f6a9014ad0ea3a210e37de4cf9d5a352ea2ff315f7be62c20c29b713dcbf9c66492

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95f8e9d35bc0f4259451705c501908ed

SHA1
0280f3cfa0d22868d2c62d27144acf2a337299a3

SHA256
06a0a921aad514c2f9129cca2ce05c3b08ebd25a7fa2bbd340fcd4f26a0388e7

SHA512
56b6aa8c7ae5559e323c5620c15c58e3409682aa0a4ddc1f0fd86cf74d6eb615191faf725957f59a935f7c900e6341c049a8d67de646ca8899a59e2a239ca7ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72c1d4b8e92b14584260ffacfbf600b4

SHA1
d87067f2cf4c9761e5f7e87f8a24898a8441e2fd

SHA256
ab9a0ce8a65ab51073c2de73d24d7fb40fb2139e77ce21857e88028c45d0d3e8

SHA512
a2b3518ebfb86a3833b8b3530c5c69083e90754a8899ce60fcc72a14a5ee0566c28ef93dd939d0d42e7e8816a35d9905e957d98e3309809c14c8bb8f68bec1f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92e7c2f636f15c7367ab0fb3cc567178

SHA1
9c0edcb4ae740f43406c7714b6c3aa00c47243e0

SHA256
0b858eda03bd08edd04098709c2e1186367aebc4efef944d15ebc75f5742db18

SHA512
23eb4222d3a5f75943779872d81fa7b59ed90336522c72c08159027aad0c4699b763d15cf30e26b46341c49e90f7bcb17615e9a667b93a2ed80ab461a3fb2790

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79087897047184f7c9012a0708cf6a23

SHA1
ef63a812dcb8ea9a6b21542e0a4556b431ad6954

SHA256
7d5ecc68117c5323d32739398e58779ebaab617292567962d8aa3fd10d70fc24

SHA512
74aa2ddbd68c5ff203a28fe9696a27bccf57807e54d16e139866ee4518956425026887a7a0f3c72b07cf7b534400157a2f30cadadf5fe6cbef61931d19816c04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e920d036c6690c7f72703d4754eed4b

SHA1
76cfc99e0f666aedaf7055d2e6b0219de4a25be1

SHA256
e165333ce7470888e541b75b36dddbb3ea0a5482ecc15817fcd55e101378bd09

SHA512
81b2b781f1f6bc1869dfa3df4ae00d005466edd0591fb25aa4c690aa4f734f1ff0723767b88c9b0c36812e76e7753e8e5bda42545bfdf439d574e7f4868b7770

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cfb218f6d26ccc3135ce48bbccda0530

SHA1
39ac1e34fa562bd4ef80e57126d484a70afb822c

SHA256
b5f340edac81205db5203f9e0fa4f320c3c8816279d6438f8fcb0a56d363d448

SHA512
e2c1987443df2832965a17e1890a5c4c44457498950ad549266918f4fe8054b63dc662751ba35e0100f16a384208fa4b701e114cc764e3757aadc4c22835a50e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc9a522ce67355b091757217c4497343

SHA1
4e4b1d8ca21f0afb5a022345b4368cc0c3d8b0bc

SHA256
425b962207bb529021138f2d64e4f3d49b8ee0ed7339b50669e513161838a298

SHA512
886a46817014050d1f84d898e684e6a5b4c230c180147fc6f84dd2253a769d765bebe0e190ed5ae8e2944a8dfa2112fff9a456b5805314ffcfb46a1c214585de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d573b2c157c90de0df629610071a4ba

SHA1
0399a2b6847630503cde8921a9d153481e96a572

SHA256
b3f6c5a1130b488235f913033d24877775fb1947bc6dd1de59f01ee1788361d5

SHA512
ac22f109ac381d8064b17d6029ba8778c3e2195cfde7803fc42059c26a95f0bdd5d0c0d2a54a6999efe99a91741660247ecafc4b886824ff5c612598e13ac0f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAD62.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAD94.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit