0222af6f9c5ec86f71fb6db52b3fc086a782230160feb070491b5aab15354de7

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 17:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1432bc927cba44449adf3bd4ef54536f_JaffaCakes118.html
Size

3KB
MD5

1432bc927cba44449adf3bd4ef54536f
SHA1

f797a674f63b3ba620d5ceeb95c5a4ea8f76d097
SHA256

0222af6f9c5ec86f71fb6db52b3fc086a782230160feb070491b5aab15354de7
SHA512

a20a1f95a80772c154917dd4428027507d3da74c1c13ac4422f916253f0b22cb22e2f541e63e68b238c5632923857a8bac8c74e47aaed1278ab257511453de9f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000027fe5d6a88fc124a89459dfb5dd328b6000000000200000000001066000000010000200000007bac09607b9e616f4abde337454d611e1723e99e07d5ba8fdc808720813cada0000000000e8000000002000020000000fc9eba9f22d5d2b6cc99163105624cf61b97d43d672a078331158aa12be9ffa990000000b0e356366c2177f549a3716222c0a66f92821a1a9342e712651f23694dd0cded7a5a47e12767652cc61a6d324bf61a2c43b35d3a9e2315d75ace872417b8ecd90e9b3b79dc058f451232eee666d8440983a34f4028b16b5c6a616bc187a1ab51cf88cb16c2e9c64926b391d1b695c0949e0d4727df8a7ae645e2e0c0960e05c8df34471470b6d1c54d960661e77c701640000000b66df41239fc96af6eb7d1007071a616958b185176d82ce8a25b1b1f8a99e3cb771f6189fb30a5c841a8bb75c6871540b6bb60a8aa6b7b81ce2d3324bd5e8f95	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9F543FA1-8272-11EF-9E0F-4E18907FF899} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000027fe5d6a88fc124a89459dfb5dd328b6000000000200000000001066000000010000200000008b8919e3b9b39a3262f53c38982028edcdb8e59872a10539525f2b43d764863e000000000e80000000020000200000009893bd33cac00871687a7ce70bed95d3b2d528bb249503a9b0d0cb6ef97cd94920000000cc844de43a7569e017c297498ae18d6d085b80ed0cc3871b55fda05fccef47184000000044968049897e1b6d3cc3a7d18cde1387947087d4e0577a3622ce8d126c66b28ada4040daaf3311e10123290f1d8f9d035310aa9ec283dfed2c8615c6a3cce1a0	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50dec2737f16db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434223296"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2520	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2520	iexplore.exe
2520	iexplore.exe
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE
3068	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 3068	2520	iexplore.exe	30
PID 2520 wrote to memory of 3068	2520	iexplore.exe	30
PID 2520 wrote to memory of 3068	2520	iexplore.exe	30
PID 2520 wrote to memory of 3068	2520	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\1432bc927cba44449adf3bd4ef54536f_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2520 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5b06cb96a5ee4d766307cf51f03db7c

SHA1
3e329131d6e2bd273e99898831ba874106759f59

SHA256
9fb42b73c7ec0a491e54f6577b74acb65fc697f6e728004610fc5f832eb584ae

SHA512
6909c7e849b7508f8b6f0e07ac67a47bf58ee7e666411b331fa2b7b8651a0b7478a7724ace50350f21a2a5b3dfb1e0cd2c2656e3c05a4206f899ded427d695d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7533da5cea41e1232d0437ba3e4ccdc7

SHA1
77be8941b6e599f5a55b4a6511cf7b0e53870256

SHA256
e127aff4847cd037bdf59abd2e4b797bce847868f9946fc9058f6138e058e1fc

SHA512
b7cd4c98f73b05aa907c009aff8e1bf68da296a3087412315ae8fc91c7b9e37eb20d3295c7d15d470e28d54ec89bfa1a112955181da5a151a9d033288b91213e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2516032fcd8858750de90501af35dd48

SHA1
7f8b6aa6b778d7c2c07a0527b588314a0130ea23

SHA256
f6ed174974f820eadca270fa584c996333db211b5ead57331f4f6652e94cd6bf

SHA512
ff9c5b6519440ea8fd41be5d9e2d2ce0e2b9a575de6441c5fe69f4be53aee7b3b0b23fbbe3c275698a2686acf182f72fa1ab64c40638ffc1a02c14e89c627117

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
19d6ce09dcd001c2e5280722e4ae2406

SHA1
59d5efc95406bc18e58ca48cb2a8165b95884a3c

SHA256
3e6f05c7aadf83729c312f77d2717a31afaade33e34302a87609347c5e5fd3fc

SHA512
4d7537643ba6016a677cc43d460e796fb4cafb08127b86acbe4226688782e9909c46f972c2a61e293adc6a899f34e36dc07910da5cbab673dc56a190eb018d9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60e44afab2634515a50e24206f63d9e2

SHA1
714fc158a77fa9525b5060cd35a42984b9a0e90b

SHA256
053c9b555622163825877fe7d7055a0e97d98f4e727bc632eea1f2d78f3a1da1

SHA512
adaf4e0388a30bc5b26ba39dad145cb5d0be96ab4ede1e061a26866d8519629b9399fd76a3975afe4a3965103800ae4e81bbf0815cd92e184e2f662196f339db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d91541ad82c68d92846c449bfd5ff52

SHA1
1b2d78e9417422e82338a227907ebafd582d77f9

SHA256
a3c449ff24e45ce1864204424fdc65e8add89045ed5cf6dc3920416fa0fdc020

SHA512
1bbd24e4ccda750d8a771398bf0849c3724a07149fb50e478caec842165b72a0d1ae2b29bfd2209e55f8bd106d9a6ce5b425adaa80741ecc5a9beb95b0577945

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
009ecafe1a9ec675cb1b8cfe6e4f7f87

SHA1
707dc7d93aafe90b07de8da9aa3ddb17c5c53a37

SHA256
8b684e6aa58a0e71faa9a7d2e0bfe953361b3e8d36b942ead82876fede9f6134

SHA512
e6a2afd568cf5e0f6b06199b6d996ce83598d3668d4f52ec9becc76172290a75df8465b35d04d30b170d539b3a4b3e926332fc6068b8039f914bfe3cd3f3a83b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bd672a043101be04f43e38841082c491

SHA1
af87ab7176a436a952cea5eba0b31ec2897e0153

SHA256
4a1f72b2b6461bfd219aef9f07fb2a647964b7c36a21a4b0e6b0bfc1e3bc34af

SHA512
7f61edf22b4971a4127203fb66a63402e257764a41d459963b2475eb40778425a05f9c80a7ca9f0fc58ddde0d694baa0073f8d8df137e96be04b2b6e7a8909a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae0395df7a77ab1884ee83fe6fe0467c

SHA1
8def770ab331cda62666d12174f7a5cb27679a0c

SHA256
e77bf5cc02f483c4085ba7a697bcbc12d686372c08d7a7952eec80dd44152a62

SHA512
68e846c92bec540424c69232347fe659d3ca113498a6bef85d3187a5a8dfdccc2bf8258b77c224b2a7850a99eab80611a641aa7f4335dad81f05b3f105bf85eb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
678163e0514bf9557df2d199775e01b3

SHA1
70a163de78f58f6b018053ad7f143228d92786f1

SHA256
4bd1c130b4a8dd53b75de69e996288370618e75ff95fb65554225ad960b0c45e

SHA512
4d4f874ba1c0981ef4193b547523bb9981348705332c9bafbebe15085edc7708a4fd0de3f88a560fcc14f154b7e03da6c564927ea66f3ef90fd9d3c901572030

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23a0b1628b11db66c0839fac20a5dfe7

SHA1
cb4f25b2adda0f9bba705c2da316d259323dbaf5

SHA256
1cbf9c68925d2f8686647b84f29548777bee402c4eab064c926f4ac2295adcc5

SHA512
72544f46c8e5d2decd5f642c422a06188a0b080eafe767c289b483385ba623df21c425947a64b9e806ecff16ae737c2452891b0cb13ef20e7b90526dc633bce7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2da42898e19e7910459de9d4ccb679b1

SHA1
50dcee1400c39c18a335fbdd8bedf37a585193a2

SHA256
69da14abafa524883aab64de330a3cefb1d0ee0071b519d2f6a3cc187eac5e3f

SHA512
928b941789a21fce571b108f4f7031110ba03b24191277ddd4ead23f8ebb4f664beadc83f72b32603f0d30d03ac6865f8cac5f36cdd98e4e244d35f4af4d9515

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb5d6761731b21c26fcb4d7004c99aa7

SHA1
50af6649245b0ecfd2f6d1bc4cbb97a0ed24c718

SHA256
d715c8702471261d8c909c12b270246ea1c835df5d27ae446f2ca4b8b85bd586

SHA512
4492ce4a9efa3765aa7afd83153eb8c4831aaecc2c8c14187b6f8a20de9131e6cba6ec1acfa65693b136d9da60d4bbed40757db6ce5c68bd1436fd11f7ef7b29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
471657f06696e18019a7c38fb15a4527

SHA1
581927847bc1389d2151a196bd9c8a7f6a368061

SHA256
72c2b7c53b88f7ed342a69a94f1c88307c4da34f2d545129f9eb976bfae1ea73

SHA512
fa6bc6bebc486f6a9a381b09f1cb5bf3733c9b8f2ab44b4561b74420ddb5e1adf9ca284d17ed274a7785d90c55bc677674cf776d1f61f2914615e54772c5cd7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04c7731b9d2e33e0969ec969f122c0bc

SHA1
d7f308b817bdccc0eacbb3d31afcdd4a58d7864e

SHA256
075f487907bd95ac3dd4717e7e549366431183a390bac86fe31b9798158571e9

SHA512
b409a3ff227affab60638cd5473b8143c4ad1885c566a28181af39128fe4662aba8ba21dfa6b9b41b349fa2b597a12d9a8032a617a56535d4b80b6edf53aec1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEED5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEF26.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit