7751fabb80d77affe6b4a29fe88b68b53773bf3dcf7826cb9eeef7248c794024

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
01-10-2024 08:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04f46ff8ef73f48d13a0ff68f741d734_JaffaCakes118.html
Size

1KB
MD5

04f46ff8ef73f48d13a0ff68f741d734
SHA1

33e58df7df54b9a01ca1e2e248ed52407150769f
SHA256

7751fabb80d77affe6b4a29fe88b68b53773bf3dcf7826cb9eeef7248c794024
SHA512

ee80f07af3b2c4ae5a40a3d5834b8576720c1929d559a331f6159e6aadd11018c3e593a8685ab6188648ffc85b2eb50698a9f0973e20c1833b6a2f224435cfaf

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B6CD2101-7FCB-11EF-80FE-5E235017FF15} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb470000000002000000000010660000000100002000000056e3d3d2d5a4752b18e00793f7be2962f7690938963dfc9365c11e78cfe8035d000000000e8000000002000020000000906d32da96e7e43ad5afc48d11e30f662e7006f69a61c42eeead02a17ecbb7e9900000004d1cbdc50d296db408e035a8650860726ca81264d1c9c0172bbdd23a23c1b1509ae3a94b7860d3af98fcbf1845864f363c0d6b563dee5ed316fc920406d661579065e8150bb756dc6314ff0417ed6a59f1a5c6d8ffecafb1a558640b996071bfabefe1676bb049c767eb7c73e7c5be3ea85493b6208e9bae9679b8cefebe5ee1f0e3cddc79627f1de3a48b01837cfe004000000027a4182cb0e7d7f3c035be7c77509e8c8d26b463f82f4ffada45fc813965847a6760a64d204c240e6b80aa418369f4835d052d28b34cd6784279f64656982c49	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433931744"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000985dd571d365479a6480c0bea473188af2adca54b237651e793cd6a39e2740df000000000e80000000020000200000003cd1074b1a6de33b446a52069c0e2ebaa1ff213733e37a17e5ec272f5aff6e7c20000000230bae58785e2936ea3c39bb2422d010f869dc52c69ad4586228bc4ffe54f2cf400000006a3580c94218de70352a5c33c27b138ede7b0808bd35e7fff9411e7b590b8fb0d839c9613b013e912a5dc8813641608c0d0ed1df1fb1859b2a065aab6ff0e89c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30469c79d813db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2308	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2308	iexplore.exe
2308	iexplore.exe
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2796	2308	iexplore.exe	31
PID 2308 wrote to memory of 2796	2308	iexplore.exe	31
PID 2308 wrote to memory of 2796	2308	iexplore.exe	31
PID 2308 wrote to memory of 2796	2308	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\04f46ff8ef73f48d13a0ff68f741d734_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2308 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66b1ef7438605554f2787469d17b033c

SHA1
5b9a581e3520abaf85ea6217a0b9bb78ac70986a

SHA256
996d3d0637c110788e181772c44d23e0e33e30cbb140b63291f97204eb35adf7

SHA512
edb5db7f9fc77c2c97daf5d24aa992e04eb9dcffb725ff5797709bbfd28e8edcc08c7655c9c4975da5b00ff6163c3ede99dc1d9c8e5cc5eca9792f1f17102b34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3450b7cab2578a21144140129c80e0a

SHA1
7e385e93dd443bc1cf5bc5670f8039a5f49a37fd

SHA256
5fec30f14cb9df7062981919b9bdcd665dc13757d06d49ffb5802bb3dd3f1ba6

SHA512
215a8422fdda4cdc67d2bbb9b388b19b29dcb1c31e636137e62b96977efeb32e9a6d25bba358ae46908ed06fb1fc3bd13b11a320ddd960acc36a1e6d58fbbd9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8531d54643cee8bf923150266bd30ff6

SHA1
da6935adf362e2f7dad2c304416d763ee644436f

SHA256
494a286b1eb59dbb07694117c3d048e67bdb88beb7c4b1e49f11530a70b733d4

SHA512
680d158fc574a1675b673aabab96288a0bbb9c9d3df4767067d6a62094f06035143c0b4c5a6b0e79ca70abd5ed861d061042b9a66a6cf9dbf83d02dcca31523b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c772262bd8ae09c102c5c52f21451d0

SHA1
e751018712502e8d2972dfcf08455c4d1fafd4c4

SHA256
0ee625b20109b73296c388da1c5631f4f28b674b1ca61ea10761325b2149b92b

SHA512
5328da798298cd2bae557441032874b674b7e95193b950606e7dbc3a7801e3fbfe776ff68ec5cc4ef0fb40899255685839eb2fd7260f2f64945b95bb26e8b0f1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a8aedccaa4f5fce37c8e4751bf1aae95

SHA1
a8f5d0f3bcb5a086322d889dae1d128c529a9504

SHA256
fbaed150219d744fe7ab87fe4663df20fbea6a3f320ed688bac52f7f85f944c7

SHA512
7870212955726c4d795ffb4d296e4725f0ff1a5bda32ba7f7d9d234d9fb704502acc1a65cfafff7a5eb27f922fc3a864f79fc1de6f6b0567e66b1c7fffe74219

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d227c8b5096ed66d3018adf0725c635

SHA1
e9d906079573628a9d62ab01e76a4e472d47197b

SHA256
adde170c88451f030f62b0e2d6adaafb9358f314698a3d765d7a340164bdd3fa

SHA512
bf6d718b64811c2810a55a040dabe6bcdad90b5a64b4d2c916efab71eb288148abe69d8f4950f43b99893dda4446bd9e2c12886099838d0abec3ae396b06e5b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
71062baf8f5ebc4efca95973e9fbbfff

SHA1
3d674145231a932fc400cc88400ee2be331ce4b3

SHA256
0283b1e964edcdeb0566e1868a6e5020555663e8ef67aaae1dedadd57b295e8e

SHA512
39d19855ad756b5c76c03b353c3aae688a1a678229a733c057f731ecb3d7260badcdee7fa2f2cfbeab9dbcef31a7c31c0bab7270e65ad256eae8bf1481cc7cc2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd9acf1fcf930f065a478e536b93e704

SHA1
32cbf6dec534a521fa3d831a8e345970547423a5

SHA256
47ca6f10deeb9607cedee4f830df3bec1af3b08e69486ec56d1d830a00467f4f

SHA512
0c6a5f3f514342f842b202c8d3cd663d6c05ddcd3e8da5b49cbaabac4bc399e16be0ee6d040e52cc00c4c7c91c94a48c8b7580e3cbc8b71a33bad965752010a4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c93335f6e0440f8c39635d732bdafe2

SHA1
afe17d854afa5a949274d79777a75e8bb6bfb029

SHA256
2beb15d831a6df0cecd90cf0e6cc3b7c7b25e68870d3ad3b19034b9617d42206

SHA512
9e55643c6ee6118e29a36f206809e823a462eadc8ea251c3878919a89003a497aba29eabb59b0a31c314f8394c55391977ca97a9a7abba576b17e720c3951e32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46288efe6d491e22f94054b032461f74

SHA1
129870911cedf05d088914215d9f1b017a411476

SHA256
66bbf33674889c216256a84e7ab0a73d2ace63e432d2c97a664e0b87fdb33c60

SHA512
20394ab2de33b14d00cf72921a5d501341f522e3c161603f46b7f9f97b6aa3ca53f3b40563a6eefe9836536bc3e939bdf471c1aea060385a7d2b08b069059466

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
105f1a014a954ac890dc649f510d63b2

SHA1
a8f52593a3e4280676faec4370c1c8bf612d9fa5

SHA256
3eaf5568e5e6a9191e6e61c5a8be6b2822ef16f9c3d7352364551aba0b96e264

SHA512
2eca4e20c5796b355eea28e308277355660e7ea3f5726921c2c86a454d94b46ee9113dcb94fa85d51c01ef00fdebeb3476dc6ca79fd635c7de7b250b28addb9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6fcfc53d0850b67469ce9d63f644ced0

SHA1
4ebdd729e735fccaa1c9c31df011353669f45a4d

SHA256
6afa0adf1e511b26b27104c08d32ed0a820181750930d48b565f8db16847fd62

SHA512
c986a0ffdc42b1d7c2873a289a01286a36b99e00ecb8b2d53c1deb85c73329f82a40cf141bd89a90ba171919d8760cdf151bbabf54aaadfa925fbb670736b72e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e2dff124f86f124a973724f8d559ef6

SHA1
1ca8ea9e7d02ef21e3fb5ecaa29a2bd93354099b

SHA256
9b01c080c18d8ff076fcc1bac131f12a0c6399a98a038c102459caa37e2aff7f

SHA512
9894498e97dfdf31c2253940fbe8ed36797259b61ac11a0fc47e54de803ef73ed95e9a465305324cc63796590b9113de49d69696af1215cc873b485b6ea7d000

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b40e62336ad1c287d891c4c3dd616b80

SHA1
6654d08af52c2f89a8eb7459fa910842880b172b

SHA256
65f2fa5b39f0626fbd112d1d98275527cc03fc49d7370f8bab144c9725ecef6b

SHA512
e9b7cb561a943496b4bf1d6060836459cde4066ec7753eac50e4750b59fd2cc698a624da52b9f6e83df15f2603a02d6b618ec3cf68e678663c1e9c44a1be12d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9eac1fa3b1a2fb0abfcdf9919ffc5e8f

SHA1
0ae62ab51b77599981c654ea2dba77967e3eccaf

SHA256
6da9c9b5c6c9f3c908916ac189dca10139621b773a0d387c230f00ff57a318c4

SHA512
3d326bfd0288735afc1e15d44a094cffe87538e2d2431fe886a7e62f744c79076a76bb4bde694eff09af85df230656c2ae39b835ef1e4602cff819012797d457

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab71.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar100.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit