1cc50c8d5faa40c2192c9d755ab5581a0a5950e5d21be9d72cf35ad6dbe1f63c

Analysis

max time kernel
136s
max time network
133s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f4eaa7b0cf596fce981beba452eb8ee8_JaffaCakes118.html
Size

957B
MD5

f4eaa7b0cf596fce981beba452eb8ee8
SHA1

497db31cfa593a5ffd3c4b9520af42e959c3561d
SHA256

1cc50c8d5faa40c2192c9d755ab5581a0a5950e5d21be9d72cf35ad6dbe1f63c
SHA512

d6f245fd9782c0e4b392556cfe6cc9b682fd3bc868d8d0493b63be9fd9822f30e62d350798d159cd1694fda9b01ea8950972b9da7aaafc2a091a1021a7d13e12

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{02B2FE91-7AE1-11EF-A02E-E67A421F41DB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b0000000002000000000010660000000100002000000087b5c8c1e888a45ed5818371f6cb3539b8996020ff7168ea1f2f5a9cbff2bf46000000000e80000000020000200000002a8fd0cd65d1f7a4bdb4574966e0be8661b93252e2298ecb089959bcb743cc62900000008560c6387d99c4678b69d983237ad729947b717ab1d092c60dfdd24fb264bcec85c2d23c0d879a3d0247b8100b4c452d000e876e5748d0c64449390ba1ddfacab5a1323747f8c0e820f92f4e7ba60b87d5b838bbc16e92ea2240eaddecea15d47a18ec61c1b0d9b296a6b02596274fa2a1dbb276f91908633c7aa45e07e76688f7da95d662dafd12d865e24a7b44e0674000000012a09efe4cb512a0037d9a89b4c7379ebf2716b1051f7bd084ea9ab05f30ffac62902db4310365962fc75d9c554bd54607eaa9390c57b7c184a856748072ee13	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3008dad7ed0edb01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433391099"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000c3c464b4f590d7474b2d7063089a723acd09bc42bb01b559d14a7cd57989d571000000000e8000000002000020000000969186b44f5a25ffac1c74d48151024b7236efc2e9e9ef278a3406b4d51042d52000000094bba930d416ee54df303d27064bc0704488b2c1d2d8c6d50791a472eead7278400000001e8b64c7ef93d7b47beadccb6c38682112769fc819c7e08f5773c106d73e31a9a7f58bbde76ed818ae41e66f0ae390395493848f82227fed33817bffb30869ba	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2148	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2148	iexplore.exe
2148	iexplore.exe
1624	IEXPLORE.EXE
1624	IEXPLORE.EXE
1624	IEXPLORE.EXE
1624	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 1624	2148	iexplore.exe	30
PID 2148 wrote to memory of 1624	2148	iexplore.exe	30
PID 2148 wrote to memory of 1624	2148	iexplore.exe	30
PID 2148 wrote to memory of 1624	2148	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f4eaa7b0cf596fce981beba452eb8ee8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2148 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ddd01c2bf89d0cf019f8af7d822c2365

SHA1
c5c137692c9cb264c2f8f11996286b7d8a3788c0

SHA256
8256a80a78a7e58efa79eb6edbdc940f56bc16a977871f54c3e30e0de516c140

SHA512
743c5186e617c8ddd407aabc81000c07f5ee6b8eabea6a55f3b06eeb67c24ac17b7db27bbb93d07c53af8a826e5e2ed9d4c3313309473bb44a8ec58f0428b5f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ff0d9c28d3a13a96d2cf7da6b80df54

SHA1
1cd9c17fa330137a70b52d222d6fc8e778327cff

SHA256
eba13488a8fddb1d9ec0f86a3f3280cdb42cb6b30c72c720994c19cb00e6eb6b

SHA512
15f021aa628d6e9d3ffa3b5ac787e1f4c3f912b365df73243dcf296fe3bb2c90c6149de9fb8a2d9ac7e099a66c830cc5df7bb6c22c977771504f53298b3c8484

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1233ec1e7668c422370737f0f98762d5

SHA1
9d6ac1fc55976c13190c98a992d190eac485818c

SHA256
f2b44c1e1eaf47033eab846ba5579c4d76835103a5b328ac8ffbb77a30731ca9

SHA512
03c32ea7db3988477ddf4be4623f4d3295e52245498ac3a58d47d1c7465a085326f895f853816a5831a0c700470e4826d1cdce8ea506ec0751b2c3f4ffa18099

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88218ad12ed5f2b5bb7b87b5e0f134c1

SHA1
91e344fe794ebe2b59819c754cf95dbc1e2a9a68

SHA256
ae2b191d0dfdb7a955284668b77956c444f273dae9bd047aa7447295a5759d63

SHA512
263723700f5778871ef547dde8eb21f33c3b36457955b6d8cb33b731c1f0548c9cf81282877038f7e71f9ade2f30a78543d27eaeb18755dd841b12d63348d401

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1cd905894dcdb53cb99a567ffe3c91a1

SHA1
57fe1b7a8ebbf20e95a0277d23e122e5ffc92c9c

SHA256
a011c3127b19fb193a5708a7728f9e18ca97284e7cadd008170583dc1d8e867e

SHA512
f518a90412281a7b65b2e840fbc30a8a66a993834140b3e8c5ddf920dea2ae62f2370a89a8a148dab4981ad31c6d5a6c6b5a02bcb14b1e961dd95f53941a9695

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bdf7133c7b8cc2b6883c15a44c3e2618

SHA1
32c049d7f83f3ac11529d5c2ff4f2fe5daee0ed6

SHA256
b5c456ba10e024fa5b7be3efba803ab72822f4ce0884ef7982b4e3e0e8974ddd

SHA512
0e795b578d4b61e19fcf4dd4df014a7611e089021933b80107d790549145586e08be0372e2456a9c25b3bd9dee9dd2a235dda811db5855b262ea386eff59e2f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6add39dfeb123a6001eab0295afe2f2b

SHA1
29a78e0eac437bd2a4670138fdca923f16ee47d4

SHA256
fc0c7681c98b3857d0e5bfb7acd16e5a7eb4598d1d7e111165f8731fd729000e

SHA512
634c5ceaca0f5393cd98cbd26789ba0706dfd69853cb59ed496538dcddaa28b13249e55b814b0b8ab5f8fd122c6d9f6a3d3fe835d44428c681e4a0c0628b0c0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
67090cf2b48b4b6fd6d55df7dd9bd759

SHA1
6fb6e72ee9fb1a8c7841310a35f2be52dbe5033e

SHA256
47de12ce8b01bad6ba9001057bc61f0d508ab25bd30204ba6463de920d13f154

SHA512
936de5394fd213fa3b440d893368ccee40473ee5440798fa99a18924f43070cb1c99ba8dd9ac52a6df7601f75bab58494c57fba4c71700611f25af4e67f2dc5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac9f785fa63f3732bc4a7ac04daed154

SHA1
db25a697a5e6eead8f6ea669e8e64bdda51d5aff

SHA256
957057230a56b045b81c9fc0893040843853a4caa93aa941336973537a2b9043

SHA512
ec4ddbef8aab32c1287c60a85e51bf163d6eeb8c93294f5c984270b770d4533c237f04fc338b49f266709cb668a0e1656c08587a0ffc4960e7b85e7840c160e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
728a356b2cb0f325d21093db6e09ba76

SHA1
e5fdbb8ad5619fcc84891fd96269d9b037c3bb65

SHA256
9a3c9d961e79ab648ec295920f7dfed60888c28fa5ef1fc46ec9998738420ab0

SHA512
2780603bb8d05b9e8ed81f231d42fc65e2dbaa5f8597d9dc935a3f86fc17ad8cf247c73f08796bd09aa14dfdb1d7dd8d7689810f077852a1bb1033da7db55a93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ffaad07b466ba874f747e9590613c14c

SHA1
aee358168737905a282485e5b65f4e203b8995d8

SHA256
d0c5a37b7232522cf3120fd4879f857641e2373eec190bd99ed3116e102ab521

SHA512
78314e916b66a4e1b3d0984c223d5692ef7acf6a1de1e0f9d359ffa2adf672563fc4bb472cbc4240dd7df704cb00032be47ec09bf9799e4b94ec8fcf98c31ee8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0763bafc356e0ea8e46b6074b3e692b

SHA1
aea05ae977a61756ebf0d9c3cbc7ec9778535585

SHA256
c45c36004d1135d7dad851ec8dd9a982e4e4a3db339cf9b53bb7eb22f6957ce4

SHA512
2ccb0cd75137b1c76917b6ae079c15ec5f46373598ba016e574702c1b45045a67fe609a8f305e5befa3f9ae9b95d2dcc95850c724f7faa5bc3ab3f7255ddb129

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b4bc4b52e0a43df9c23d2c24f764516

SHA1
5996ffb21142df9dba1bb491a32d6c176b63a706

SHA256
0f90ae3b4fe1d78c3f8d6aaa66b2498d4c6d35280ff35297987c60a58018a897

SHA512
b8926a9bbd6758f330a587f8b5731dd80df617760af980ac7ac9018eb292c602dd9943078725cd122420c4db6251a20862edeee77917d45089e4fe3df7cadf5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB4C1.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB58F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit