4c2d224e56e74f066f5cf24ed28ec653a253feb73c7fb602144ad26b5d9e1bbc

Analysis

max time kernel
142s
max time network
133s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 18:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f69065a3c00c80175a27282e3572f67f_JaffaCakes118.html
Size

3KB
MD5

f69065a3c00c80175a27282e3572f67f
SHA1

fd2bb3481b29638dbbd48766acd2ba0bf49e7cc6
SHA256

4c2d224e56e74f066f5cf24ed28ec653a253feb73c7fb602144ad26b5d9e1bbc
SHA512

e69e1625dfd5bbc9f18d08cd6ddee37be31b96110dd54327ba15bcd3d193bb83164a8ff2e3294b36eeeb87504b73cfde60d7f0ad682364fbe3f43e8a7f4dbbae

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000095b16d49afc4f04a94f106ac834838e5e0caf78523a6262a964bfd4bb108eeb2000000000e80000000020000200000009f907020dc24a2ebca8a81257f23f0278d78e4f323c60f78ef8737d80d6086862000000048d303f0a75960570742621b4f21cdca76691df17a6bcc1d0e7d1b0563fe66a5400000002eec3c946ef1cc4fae5a7319a7159cc49ccd43a178759a01ccbeb66d148135faae5057fa3d85baae1858edfad35e46e60b40e5ad941480227c3b46e0261c2431	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433449171"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000003fa98d2aa57faa1b4c73ea0b80fa553a313e7b2f5f774b3024ef0f0c3c118b1e000000000e8000000002000020000000ec2560de2a7c86eef0465e0b65cea68cbc794bc297a161460da339d558bafc6f90000000cabc8a1a660d7b2085a20e1000a89a8fc700c88d4e798b65b323c85a25c5edccc34d1665f0eadaf939c7e5260b2da490086ce904d1c9b05fe645e86dc5ca83b325598f6922b8cbb1dbd19112f9b07d73b7e55f68e9e49fa0ba8daaebb97878e356a43a447d015bfcd82f57e85ac7f767acfb3b34d5ca3c26f91fdae63354bd79834acce820f2af78c26597008b6092b64000000077f25d0cc042b8209ff1e9a5c85b3ceb970cca3934c813101bb305968afa9abb493133268357dfa37a99d0d79b05e130db2c8f6f7e7dfccba32d5e73e0bfdafe	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00331c4f750fdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{37A7F4C1-7B68-11EF-93A0-E2BC28E7E786} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3004	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3004	iexplore.exe
3004	iexplore.exe
1240	IEXPLORE.EXE
1240	IEXPLORE.EXE
1240	IEXPLORE.EXE
1240	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 1240	3004	iexplore.exe	31
PID 3004 wrote to memory of 1240	3004	iexplore.exe	31
PID 3004 wrote to memory of 1240	3004	iexplore.exe	31
PID 3004 wrote to memory of 1240	3004	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\f69065a3c00c80175a27282e3572f67f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3004 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8aa0fd1dc4a4a60d07a5689fc0ac9f89

SHA1
7625d54999acb192822bb247a8e63d45032d112e

SHA256
7885fe1a6d75eb0560d02b0c12cd870b70db699ab7cb8c5d18db47929ef3a178

SHA512
53fff6f66d3c2a484583c7cf9db458bad715860d4bb613364391a4d233785d1e13eee680c1295c333a9aa8a1771189d308b87c82fd61ff4ce3f74c68fcec73bb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
91c37b59a8a34a126ce07d4c622bf486

SHA1
3b65a8383afa9eb0b75f171c0a483c973b427d74

SHA256
9c523804f3fab69712f4b821266a07a53df94144dbad91c576efa15cc40e374d

SHA512
7c764ef7ac77b656c6902082ee5e9c9bd8574b78ce448e1697f20c76e0d854c4199e46b7f259edf0ca1f565089ce7be6fc085e311bd272967ae73a114a266c99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9e68b7c37dd9c37192227a6323b1591

SHA1
4e97ff9f6d51ad5b171e25a9377ab6d8095e59ea

SHA256
8735abf488c77c2ac643b4c6c5f700344f2a39e8e249814b30b74e3bfcc519cc

SHA512
a041c6ea89003416d48311d45d24132cf33fce2e135c89be2b09cd0e8ad827a477c80aed81d88c0ab4ba89e1d07476df8ea9bb82ec22c3e9e76ca6f090acf0b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa85359f1359c83b06088165d06c51a8

SHA1
fcc979f246b47283d8a294e4f76664b97812da36

SHA256
0e9335d72fa4cbdbbfcb16269ec093b6cd61fe45af393eb6789edd1b67b0396f

SHA512
69b09756fd5f04249c36f0e95a166ce9bdae6fe37fe8e7ddf1a060cebeb6328b00743468ed74dcfe36b30e40391af7e6d0060459ed77045fe341662526ceb6d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d87d39bf280b608f53a6d400b5234d2b

SHA1
bcb934714ca6fe7d3f818900f28c64decd0d07b6

SHA256
cfbfeae9737027ea001941819135db733573cea0e6981ed55d66d5a6b263af35

SHA512
bbc97340d896ca3c1ddde94bec15aa76d76c4809cf89b2b01f20936d39857b8e37f53a0fdad31605a122b489f78894de207492b1b586b32fcc56947bc7fbcd5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db25326202b66d26afbdc058a0dc6bd0

SHA1
f7e404e61a3149ec32fc195175618bcbdf0ffe98

SHA256
0fcb2070e498565218eebecd03dfdc63a416d17e1c58324d37ff756b382cc814

SHA512
5ae3550b26911b2149e92bb8d280bd242d205d2615733b86b75c2ad245eeebb9e0ef81815019f63f013b426cfbe41e98060b60967878561928f7ef277ca6a33b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE014.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE1FB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit