4ee484792c541831461f2da1b4176da564598e941930a811c91b2b605f7b0b1a

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-09-2024 13:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

019b5ff0724508ac820dae97a6cfec5d_JaffaCakes118.html
Size

924B
MD5

019b5ff0724508ac820dae97a6cfec5d
SHA1

a6362a56bf863c068142ee150c0153a1720dd95f
SHA256

4ee484792c541831461f2da1b4176da564598e941930a811c91b2b605f7b0b1a
SHA512

c7331f1f59bdb613dc931bfe43b04891458a348598f3b21504ddd56d5cd453b1e78586736b761cb14451f27052ec729d2cada8643baa174c8a15bc3a75552376

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b000000000200000000001066000000010000200000006212c2c4d4132dff3004fe5ba23fa699955d1602b898af2cdd7f7669a909666d000000000e80000000020000200000009a832f359168433aa046a269c38cccaebf7a55e2fbc792989394c0cdc7338a2e90000000a866e833950cecfaa8ce0dd896c41c2b47918972a37693b7bd61f17b1e46f7ef13be1f47c655c3451e058628751ad68403c1163adfe2301d5f0cb313c25a70900914c071fb5fbd464ffaa74e0e5f99d5d18a286841d773dd1d65df192eb7dd848c789ada38a7b3281dadd489520c4d7c209bff9885dc39705850aa79d506986d55e28401eb7a8a7d5d8fbd01613f90034000000092e735ee93886b0417e3f8d44a2e83fa7e3d2f6dc67d5a1abd8365d2ead963299087a662be00e371919dd27e2483076676a64375c4f89f65c827ec9db6cb401b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2882D291-7F31-11EF-A1D0-5EE01BAFE073} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 008846173e13db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433865327"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b0000000002000000000010660000000100002000000028773831809b66472d2996bbac817b53a90920197edc4aca7e1c1a9bce2da802000000000e8000000002000020000000f29915fc4d9096208a59f55a465c5ba5226a11081c0ed56bcc4fb8711d7e0ffe20000000698e888418b58b57970d7e46e77867f363c0e7a87ee7346788fe533faf1d7fe040000000b4e7c0c1f9730ef81cd386c4340acdd031e84b01e7671abfea0fa7fcafd8d24e66d49ea0ddcd12dfef2600a6445a5598833a22a24b421adc002f35b5a74d9975	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2732	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2732	iexplore.exe
2732	iexplore.exe
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2500	2732	iexplore.exe	30
PID 2732 wrote to memory of 2500	2732	iexplore.exe	30
PID 2732 wrote to memory of 2500	2732	iexplore.exe	30
PID 2732 wrote to memory of 2500	2732	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\019b5ff0724508ac820dae97a6cfec5d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2732 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd718a726af8d470f0dfb74578feb293

SHA1
58ce74947fd8a11ff82b95f35ebc15f669774063

SHA256
acb11e3069a1af4b46ad4359f4ba9f41f08c39a40377367fc2f9f7a8f73f3870

SHA512
664605e34ef0b41e01227702716b72d6f088a684924cd99d5dad7dc04d26fb5d7ec5a4999687c06d146169d6c5245628e812cb4b1e8c02b113b7cd8e1cd6e430

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ab58fda536688c01644dd05cde75f18

SHA1
30f95dc952dd143b23231f73e6138f411f5ac474

SHA256
9cd5955a2687d480770c5130a93f97ca9c9b84af2ee26bc7eed19a630754507d

SHA512
b9c2d83a47ea4830bb8d05532bf5c176b90148851094e92c6dbb5a43265888f32ae06c621a9bb362d3475f5e43530c829b4e6958642538390ddc44dbb4c46aef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e7836de46bcab6102f71f425b5b51d3

SHA1
ac8822e5dfcd50a15134249b3afcb6d76578c52a

SHA256
4e112a4d86fdaa58c7e70006526d90400bc01f9b4e0aa03b7f60d6ec28fb8be3

SHA512
ce0944915d898ea61d5cb56229ceb247348c4459a7973c232e53e102ae7dfefa3f0fd09646268885ce8168721890dea9d6caa79448c87ee5c3b230d7946907a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23aad9e9531a7f0d8ec6fea89277ad2f

SHA1
66fe38f6e612f91934c4062e27deec0313f3e7da

SHA256
00e6fefbfbb07a0d52223e5b2b7c0375cbcf179b7e01df556c3ecb1e8baa2955

SHA512
cc3551e5d804b763151f375aa8a32a9dac862a0c97f318a86e9818a775d76312901ceedddddd9ccddb7d2c074871bd56acaa55ae47bd4d9762851d400e5fdcf9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24337bd5713f4f2f34993a4f9175902d

SHA1
2935f918ce43fb37d666b311c8feb9ca6ba245d1

SHA256
3d03866eb9db09dfc7be73af2440d357effba520c9602fab29da77a571728273

SHA512
e9daffe82e5234d47e1162c6724ca0cde76cb7bca068e3a203d5b69ea06de1ce8ebdeab85880ea6a348d0d8ad2ef05182b877fb7a67919d880082eed27c64de6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7fe9123f0762d78765c9da904053f82

SHA1
40a4656512984620f18c8de7645de8817dce1edb

SHA256
b955410bb6ae899ca090f2de29b84adde3d9fe6116ae95724a325c63f43d0077

SHA512
46cdca5af2c181e8d3056876b8f342a1f84fff29d4081eb86af9225289e1862384c81c9790abfd225b0228adb25fe7c10ae59799464724533fb4e37027985fec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a2ebfdc687d29fc1e30d0bddacafb11

SHA1
d071ca69f43db7937b03002c96d1560dfc158a4a

SHA256
3e71ecc9cca07a9ac7e9949c1eafb7b1ab4097ac8763f8d7e59f124414947762

SHA512
9f0533a38102117903f25f6c0d9bb7739261a955c9bbac5c184d62c2137bfb3c9179848ca822d325384babe5c59f0d184c6bdf02c02f72f450100c4dc9b72798

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd60f9beffcb919a3e39d94945c06bd0

SHA1
4d0208d2c4b4a0ac8ef61b1992c6716ef1ec7c7a

SHA256
ccfe92f3487a0a02c4d799d057348f26e4928ebd9cccddcf7e7acd3f3c711eee

SHA512
841561564c970c1083fff2adaee15348166d5e9329fc81f11f37f5a01b1c3c0c5b40e229bedd0b423b44920ad14da5b1292b885e3aedf3edd86a085fab6b1d73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
232dfe74af38ec79206a93f30f0d142c

SHA1
36967b85474333c522a754379af5ea98eeeb503b

SHA256
4997070cb5e70641bc27b06fb452c677c27c34b790ffbff57a325d0797a720d2

SHA512
972b2ae3690f26742c46e276c2d7187313837e344ee91833fa3ba784535fd53faece878001150456de8ada27c75b38466ccebfa28f1a7a751cb7e0c8a08cc0a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9870cf116ba7bb875236356f0379976

SHA1
79792a62108ee001bac279f78442405288a48cd5

SHA256
0d053d9fb9646131ec0d050ba9898bb665a2111eb511a881ded4aa8b0bfd1146

SHA512
3c8aaf5e64bfdc78d7742f41ad60b4d5b6af76ac127828c5838113ab881925ebd9ec1eb6aca6351b241838ac6d6c9e1de4206c2185ddac556243591ee3dbb907

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a30a018a2958bd851bb762e389e06bb6

SHA1
4b1082f6207b53a44292a6f62dcca82563e26fda

SHA256
708ebe57db489ef651cb1675e936d6a7a22dc5e32095bfdb3c30239324e43b46

SHA512
b8c40b26e6554b23721c4e251bae36bd8a78cd0e6b76321b1f79b0d74bd11368154829846a63e327e447704958f26d352eecca16f475979ddce13b6c1ea824af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ecea646a1558c9928db0e4a0d1d5e36d

SHA1
2dfc5ee6d52f44a5dcc64e9fd72576dd243dd8ca

SHA256
f0417640d13b1aa7164f7c6a0c3b8a691f91f1a3174109c4c296da6752ccf540

SHA512
74f877f7ae8289f9199fd2f01ce6ce6a5b3b5e0b72cb3fe90ac5fb3c4f3299af145e4b13046fa8d6537affad1330f345fcdf01d5f14cdad27235c0da56617ef2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
933e32674e82cd26f9e2fb4a0e2922bf

SHA1
4ee1a7548de73ae4b542762c6f17e6407ff4b3e3

SHA256
805505b0fd0050194749a669e2b50e9d71e19c36c71caa0ef91ce2396465a551

SHA512
d1467eea8f46cbd235fc11a2da0e6586b6401f0d3a301ecb859945e5f01948c2ceb5830f172a795e0927a69f6c645adfcc481810f72e1d3cade9fffc4f69a710

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0214dcb922059ebdd3aa3082ead8331

SHA1
26bfe0b4e7b5e863d17d91a70699f1c62177222b

SHA256
a363e7a4e6184cdcd72a60e8802714e32858d2d56c88762f1655b30f9a9ab781

SHA512
9c21c0ff40e2684de690b6405413e060351f3026b9d6d8e41ca5e7daf44c63148d52a6d02a145629c6c183822ad2c3dc7fb0c04feafb6686c98b9d49a443253d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1c3d0496a54d19af3e0b7e0d632af790

SHA1
ee3de4a8dc40ba435a5909ecae6046723d2f71ef

SHA256
9c70dac765a5d8d1cc61e11042e12760aa6968edcabe513179a62d9b53fa5fea

SHA512
b7398c9c7bee1163f87cc985a7b3279f5eefe148ef9db8a4e2b8f59e6daa3ea3544efe33af1444c686ffd5002eaf08c66aa127e09dc6e33ce90a606494cb32f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4985e43195fda7e9178cb6181d76e7b

SHA1
e8b7cd45db7f0878c58e3cdda856d9b1adcdbd1a

SHA256
1b2ed9e9ef4cf0bf3f529d2179ec9892ca91b4c18ef8d63d3ac7903dff8cd5a6

SHA512
8242714811366808df1d8bd93955afdccdfe6d0da686c2cf483029671b77d32faac1b7e86a09601ce3a63f89190eeecb9239f9655f6123945f259fd294dd2232

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFE20.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFEDE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit