c07624714c65a1fa50ac9cb81ea0276445c49c3f88272a71c08cfaee1a576cf5

Analysis

max time kernel
121s
max time network
136s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 16:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f02ab35dd84aa009375c1ff0749a53c2_JaffaCakes118.html
Size

112B
MD5

f02ab35dd84aa009375c1ff0749a53c2
SHA1

4493a965c94e575414f006c131aadb9f508dfbe3
SHA256

c07624714c65a1fa50ac9cb81ea0276445c49c3f88272a71c08cfaee1a576cf5
SHA512

170a1eb58e49e9de0e28bc455e04f34b3961aa7a8bab4c1bddb0b856b8c3b1279e10c61f8b4dddd185fba8ab6298edc161944b37e4ad8c9d262d202c2b1fc3f8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000780f97197ab62fe4a89dfa32687e2a6bbfb8e6e1ebb24ca65e2a6395e9102daa000000000e80000000020000200000005dc5d80e150eab97be147cd37f9de69dac2f6dd727c42856d83438d7f6c5e45a20000000af955b9d6217f2ab7d990b61545b8106118978c3e0a9bf736dc902614ad7647f40000000a388ca8eb3803cc576a84e1a40e97acd44d3b8d49860a66280134abc9bde1689e8efa37977e28c535e44990640f13bba16b31982307211fab15d32904164742b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 4008e179410cdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A4F225A1-7834-11EF-943D-F245C6AC432F} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433097168"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000002cacda967cb15fe70899aa8ad4310c6473e39f4cf7394d4831f7d9f89e7de66e000000000e80000000020000200000000ef53d180bcd0987047370a4acba847d01c1da1583fb10314906b6203c39e619900000001d4e015214e7963097f673a39a7b8dc34eaf9ee27af294e9c9cd95b511b042e65acf9b27c14856258d73473614eff8511820c221dff206e71989207246d02e9b8382636fae65dc6c7d1d12f72b07d0c18aed9fde30d3734120975d33d210d2428113e5cfee1c546911e6e27aba5c3993079f500ed3d6aaeff06156b56a8fb3a7fe45028a15764c76e2c7bbccf96866e640000000d5e0257e0357923e724878e8e110ab51af4409c330172f3288cadb8dfd923515e81dc97fd7b72050efeec9cda49ffeea2563110093f34e6183abba1bd88369cb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2712	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2712	iexplore.exe
2712	iexplore.exe
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE
2716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 2716	2712	iexplore.exe	30
PID 2712 wrote to memory of 2716	2712	iexplore.exe	30
PID 2712 wrote to memory of 2716	2712	iexplore.exe	30
PID 2712 wrote to memory of 2716	2712	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f02ab35dd84aa009375c1ff0749a53c2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2712 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f0da292bd9bfbfeac4bbd0aa30e71b0

SHA1
507235e497405b64aec9bffc957cd9babdc20581

SHA256
bc0cf87c74d22f40103378958826c342b298a9274854557643a07af252144ab6

SHA512
75c9c17c01b74db12335162feac91236f29ce9f31f2f4f2eb11012d5c01baf24ecc1520d23f1b0091f3b4a4b850bc1af7789e5601fc8377ca5c8c4784d857f96

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99d267129ff58145b8fbe34b0175ebfc

SHA1
1c2ea5f73c5dfbaafc2c1045aa452bbfd813d7c5

SHA256
884025b6319287ff5fa1695ed02db71e8a86d836291de22334726bd3da32f8fa

SHA512
c50553db09ab51c6246baf4ea688d4cc0042a22a2551e18c8304231e178a01121cad921014915d9b61d1217b8e475082b95fc4800560ac02e797ce98443d1bb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b8eeb9fde00ab21a1df03ab49a56b03

SHA1
d0269d659d9f1820c80295aee6b1b4f7d3503f3b

SHA256
0d91d7c548a43e720c700c2d4d860a728e54b64990bbcc4f6aaede5e45b45aa1

SHA512
02440e38402a331fa392bba7a236f9280d94ce9f8d725691ca05e167d92dc5d31af074970f365fd977c6208c7bde246fdf088714d01c71dc05d953eaab895b17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0fa5bc46a67c9c55975a9d40bc9db803

SHA1
4639c63c563d14ac0cae9b88b3391c24daf5585a

SHA256
9177a39e955e60b7dd0460647621ab0d731d1358f4d7553898dacb65be767762

SHA512
53c9ded0f0f17eddbeeb3ae72b3c792a4ff603c5c7d1cd8fdc6caaef7e02f0150ead9136861dcade084806569d81c7c79c98e02b2f9d7904760528a37767ec59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
44392bfd83c4739f37fbc80e5d4bb535

SHA1
44af7084e57ad5d20de98a3f94aad5f415ed6cb3

SHA256
ad37d09e08bcf916603830ff2e4ba224e5b8281b4c7ba0db6cd22a575a66b628

SHA512
738f80a42c286ef04874f1cf738a9964f98ba71d7291fcd14bac756d0c85eb6f29d9698a89478d8c0cb916dd87e9aa86a9be533ed31e38590ce1ffa688638da8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
647b011fa30cdd10d255904e363c82a3

SHA1
e1ef7d78ae64446a9d53209c3fb850d27aa735c2

SHA256
512fc96eeb60c624750df35cc7c80beb6d847da002d7d8d8ac409c0442c24c6a

SHA512
bd3e2f61d825316d75a3ec8989cb8b918591d194b57627edb17506b1715021b3f910af0350ead15bc9c008f82d8198c6324abbca6153ca3a149bc09a0ad7c3bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fcdfce1bf38433bb72461716dc0a9bfc

SHA1
1b5162ba497bb1df07d94baf4f64fcad2f095cf0

SHA256
dcd1147ef41aad037ce021a0825f88d72894132d3592dcf526261b5322a8403b

SHA512
f626c8e3a6a84e9e14f651d9e59041513e1bda0cfff50a42dbaa9494fa62deeddc37e7a9553ad99d804c23e27286cfa738a989222063f61f07c1b36c53feb339

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d54e2214b3c42c2d1ff84af709164c0

SHA1
b76af633540f91936f36b30f679853e316b9d96b

SHA256
8c5a8278cfa5af3e52b1f936c67801fe31d7def8732fd0f74bebe716c8cfa883

SHA512
0b974b7e968366fe749802838c8e087ff115011bcec12b0e2ff9a77fa0770fa7d77c9ca1b622981242a2231c8e24b613a60a06935aef7cf273e28cc608f4170e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab59A8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar59E9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit