560cd707ee3cba788e1252e42d88bea5d7b894e4fca39fce09a96e47d2844fa6

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19-09-2024 07:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ead164b502b96a621505d307c8b2090c_JaffaCakes118.html
Size

3KB
MD5

ead164b502b96a621505d307c8b2090c
SHA1

c053107b8d3343f9824e2bfe1156fda5599d4acd
SHA256

560cd707ee3cba788e1252e42d88bea5d7b894e4fca39fce09a96e47d2844fa6
SHA512

d592a6429faabf0e58c3fe44e00466d7e3615efe80d47a4ba61f9fbaeab99f3c1d376f42b65e6cc72cb725e892400bd693d68a060ae51090780db95ab657adc1

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 108fdeb0620adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DA9861A1-7655-11EF-9257-F6C828CC4EA3} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000007b58244abf8cbbd3456258b0b280ae70f44b4c326928901d1e3a75d968423704000000000e80000000020000200000004879acbec5d1a02e610756f7371cda4b5500105b0d3744ff535fd624f5a4de00900000002f50fe750b4411fbb3303da7359046ed90a6c333b8f0681dc098e115750d0284458ae16f2c4211de256375a9b1e185bd0c64593002d8e025a8f0c07009af26cae04a563aea2cb1c7ad11d979afc66c4157a75115c10b758c14297801b1094c81e6eb5a162039edf654e2d86b4d8e0585e9e722a132c1f537fe5e5ec743a9c7f1605722afee94cd379d3a5e8594d8978740000000173244524f026671f6c432c1a8924f3d708ccc3ee6a522955ce53687b340b03e82ab44e01d413a5781885f3d53c0ec092e9ed2054f34d7952750204696b9e01d	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000028786cd75441b615c25e492664a0ca0549293ba866e9dac63efbea94569cee0000000000e80000000020000200000001eabeccaa7c8f62d91bd21f23178f498e7b3f73d5127f4f60fe57dc12896f102200000007b0d5879e6446aa119e2278acdfaa2aa0337da09b13da72667f8ee3deaab7b8c4000000014fbec85299723a3edc9685135d3c5caff449854c1bc08c9f9f20d23f2f47e73e9656feeaf8e09422c1997fc41eac3e1dc55b1fc66d99e8f34ca72a4aacdd318	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "432891526"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2144	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2144	iexplore.exe
2144	iexplore.exe
1564	IEXPLORE.EXE
1564	IEXPLORE.EXE
1564	IEXPLORE.EXE
1564	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 1564	2144	iexplore.exe	30
PID 2144 wrote to memory of 1564	2144	iexplore.exe	30
PID 2144 wrote to memory of 1564	2144	iexplore.exe	30
PID 2144 wrote to memory of 1564	2144	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ead164b502b96a621505d307c8b2090c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2144 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c04e5bfa0e866774274417dd6215a178

SHA1
71d9eaee330e06e4ee6d27fae410f6b0fb0e6fe4

SHA256
8c7f396941f594114ed06830c0d4e9a637ae9f89f6688d8be1f9f4c05d11cdf3

SHA512
4d2a5bd901b94bdcba245d5ef31a8a7e745eb9f045a7354cbc6812187510c444c029a89c32d0346baa35a6602314d32e328f976ca708be286347a830da30bb84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98444e775e11f9aa8dbbe75590c4cdbe

SHA1
93b86c84995844cd2e486d3a6de2aba45564ac52

SHA256
aa10305556c7801ece4b4cb5ae0250e41adcb634bdbbdce0d15f6b3b2478887d

SHA512
73f4304f8767a07d69ad0514e0a5ae4abbad0625834fdd537fe7727251081bfa35ec6c9bf703a7a81a0ac8d334b3430149d6c1a51f0113066400116e7b070007

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed6e8afac21a1566995a70b8b9990557

SHA1
d5ec9d866abca387d412a8efd723524502e73b2f

SHA256
2461936e148d17791eb4d532be03a5c3d9059c80ac3f665e96a52677f7f84179

SHA512
32187dffe381d78f69e82e895d2c8efb3b5814ce5382f64469f5841f03c8445a72a8df301ac58bdae29841b3e919d652a8dd224c25a19fba9505a1aeb62af3ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb6d9a7ef1dbffcb112b7da3a6b89d06

SHA1
c1f882df5fa260493b4b7968aafac14a64c36657

SHA256
42db73e74dbaf423efc775cd4b0c60acdca41796b9c17282816f6b7b064eb7ef

SHA512
7ca98b2bcfc78e4bb424bdcda0978aa557ce2d482687d4e8436d371accb6d832abe073421e432cde62f65771b07397875b5e513cb5750e1b797f680e1acd14bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c01a89a294dde6c5d8935fd917a8005a

SHA1
87922dc8981b27db08f7f276b340617db3ae6501

SHA256
a9a9f0f2b2c724d94a953a4aed82324633785f177d1ade16d0d6b088ea87aadd

SHA512
f776b4588ec2e143e46e2c3c41a1280b1155d5d7951ab3f1f410ebc829701d9c0fafb9ee273fc9588c6181e1a5173e7c47aacc96821efc23fb578142fbe33ac1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d562ace104b87d3f41541b2d9302a54

SHA1
862b9f5251dc81cf3d2d513be4795c0572173a02

SHA256
57c8f6e4d17ad8e406fbe6f6c7a3935bf4dbee4e279ea79aed401fd45c8a3e77

SHA512
5df985cfabaf59ba7059fd6724a8b0e522e4f4259c369a761600e7f97f7c55e0b9c125a145d560ec94f7b4ff82fd97ae7228733266a4bc15b5fe271b8c21979a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22d0747f1ae24c3e6417a9620527ae02

SHA1
2ef60c99672e4386d98c7b951600ea3fbb201a91

SHA256
54caeddeb798ec1265c1178bfdd676e1bb124251de6f99b3f3fc0c54d175e44d

SHA512
6d33e8cc7b998d3f7fb53283cd8f54d251741219c40bcb6b9492608f92c45cbce84d766999780cb9e1ae251d53207848aebcd8058d4d148e60d53fdf91c99a4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2846e039f4469a30aaf74117ad836c5

SHA1
afce60df22ced34125f73b9d887d5f12c8580667

SHA256
643d1a4c8332c96827d0ec6b8d5197ccd458a688af5fc65d9b2edf284e84bd9c

SHA512
418d7235ef2bdb4b7a9c6fdc94e93bb3cd138c0d5e0d1c2cdc023787cf799fff34c42a15047d8b1ea7e92d8093f56be35b39ded3def85c4b998332e61687ec2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9eb0c75dfef626a6830ccca4ab6aede6

SHA1
e27bd4fcdba20921a5343499181fdb9aefb8d430

SHA256
f36c33d975aa419d5cafac4b7280075f4cfce2e196bfd88ac25fe48d0cb24e93

SHA512
ce4dac97334bef5016d5eecf74fbcd0382bd82793cf73112d9de3210d2e27872986ff1e01a5084d7ea4b8578a5761a7e4c6ac7b7a5cb5e45e71793ba7a007871

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c2b5d408f73d4ca397113221f1ccb43

SHA1
3e5ec684eaf36ddc5656dfc4bb19f00770228614

SHA256
82445cfce043f352016a3e61ebd65b99d8365746f974ddb92ab6cd8b7c3bb64d

SHA512
1c55a7b0ef20c83856612e4d3ed2e80e3d472db52e3756ead0d89eb5c429b769c351554184da5ba8d6363d6a7d16a20f79df4decbf9ab7672f3b2cd2adfa0fa2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d6976a49f0cecc9b07f100007599b6f

SHA1
f260beae32ad7f9881c4f2958e34040634878be0

SHA256
35e86c45367f774d04f807e4fa62d757ef0e3933ca5321ff4b6022cbe61089ef

SHA512
0509e59d21db34bdb9a80eafafd5cb56f03e740d45142127e3cda5794085865831ab5c1070d652dea5f72cd0f6fd7d5d42cfc86952c8507740f7dd33ccd5f9d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e34d1904e863923a0783c8f2edd0b6de

SHA1
73573a2cc834dee4f2c804942adaa017e3ea1841

SHA256
83756036630d7209e9bfb3a95d8f7c633d12933ebdde0623161fbff86e545cb0

SHA512
802d1c45d1e8b786e77f301ecc1a6a5f68b9641a74556d82f433e17c61c7e3871ab1b81e0033372f503563f6dc815402be65bc24a607469989da58bca961f913

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF4AE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF4C1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit