356976a023ceef6ff95f5f02f151dc1b1e1478a3bb19d85bea6ee43c0f49f9d4

Analysis

max time kernel
140s
max time network
141s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
04-10-2024 17:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

145524c9fa6ecfb3d65fd0636077e8d9_JaffaCakes118.html
Size

573B
MD5

145524c9fa6ecfb3d65fd0636077e8d9
SHA1

1af81c3e1d52fa97d6a12a074249b00daca72e3e
SHA256

356976a023ceef6ff95f5f02f151dc1b1e1478a3bb19d85bea6ee43c0f49f9d4
SHA512

ccc760cc1be150bf5b8e783da3b26ce1faba734c5d9340324cab6833fe5cfdd2c32e008d6f204845d8f5c0f860d662a6cac668ea7c168539cacf44d8e0ab301f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000000719132a72afdded76fef61d62d43ea658c542b5936455f8cea341b611534bed000000000e8000000002000020000000b80bfc75559c594b4e92b0782ad3a83240aaa1c9288fd6ec945c846496e57bd0900000008a6db51834e8b62a0f7b3db35b2a21544e50a0a71d9acfec7f946a1acf633dcb98af95a7ae8b4769d9b63f458f76eda47632d1ee345a27a5b7d96c61a9eb3762b06cb63c6ad4682799d6cd3bd56efe18304e2331d708a412767d6ab57e8d44f5948bcc2e5a494711523cacc0594048c6c631f19f45ceec5624afd08dba382b28d221db245a976df081670ff53ece7d0240000000d0a1f9c0eb6b997a76729b6275850776f94cc3589c06a8089b2652a1af7c0d18f6b84bda763f2adf0668aa5adc8c42f1bcdaa22b59bdf31fa95a498e24c93ba9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4B47D561-8278-11EF-AB2E-FEF21B3B37D6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000002f6bbec196d53b966f929e48e46c5888a4d8e6cca3392f4486dda7973f813ffb000000000e8000000002000020000000f6092cf1c29c92dd89416c8408fc6a1aa65342ddea4617095c3e678dd2e3dc7c20000000a38ed22364b20f31d332a4e45bfbb8eadd487e42d61b571533fb819213cdda9a400000002e471b52a3487ff19ed5f0cae79666b628a496e20a0942cb8fd2b53642bd5edb0c9e67950effca58dc322fdb6871605ecfa0706a186d8d964d77eae74e263b67	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60e679218516db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434225732"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2640	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2640	iexplore.exe
2640	iexplore.exe
1716	IEXPLORE.EXE
1716	IEXPLORE.EXE
1716	IEXPLORE.EXE
1716	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 1716	2640	iexplore.exe	30
PID 2640 wrote to memory of 1716	2640	iexplore.exe	30
PID 2640 wrote to memory of 1716	2640	iexplore.exe	30
PID 2640 wrote to memory of 1716	2640	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\145524c9fa6ecfb3d65fd0636077e8d9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2640 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90b6d3ec955d7556c95b2072b5cc8933

SHA1
02e06df0832620eb4fcb42c6ca00eb6c202c8a1d

SHA256
5a2335cfba9a1e0077deb69738d9332c647054b1f813cea946cd21d89111deaa

SHA512
d15f9d7f43849b816c0d01932336e248f05b6f24012df658096012118ae89e43f51bf1db5e419f7c497eb73894fba75b7e148eb16e1bb461d0f10ae405e3093b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d02ab57ea0ebff2ea4ae4d3f521c6d58

SHA1
d7f6b3fe99db3481ec61f6fd75ed4b7dfba6c038

SHA256
3f697887c163a77b3588e163792ce5eb9ddc65cdaa773f93507546550b34cfd5

SHA512
a84bc7cbee43fae9d68b58f48c4965c164229bab98071533f2e8aedd024f45ae863d60942ea43c6db9717a3ea401695d562ab250a6a01f34472c4d3b23abe6a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
978be7fecefaa9afa4062616fb94cc2c

SHA1
54fdc881e00653eb7546acb7efd250b740bfef14

SHA256
e7498eea3520756bb2ab1fbfe6457c71e9522ff2a5095fcb264e6c9af0a85580

SHA512
6c0b15d8fc695dc758c15a20f2fb27baa7e6e6922ed0457c0d4195083bfbb69ea28ecede9b5ff61ac7e28902bbb50c8a54f4907e0d684c18e38d73dce736ef47

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2678d653505ceed2cd8ff0e65f97700

SHA1
c624462fb9a61eb7bf5fa02431cb0e9e54e0a22c

SHA256
35ebb90016765acfdf130fbc7dcabe3d9296e874cb0f9a02723bfd6b1ad11dfd

SHA512
543f943850800ca248a208856b972ed01340cc020e757be5de50edc158251696c036a8b5bdedcbd54aa9bd9d7f3ced396a8aa0d90f68d6223bdcb70385ab9e13

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03ae6d17dea950682b7c61677b06c69c

SHA1
b48147a2fcbc5bd81d7b25e1ff153200f723d49a

SHA256
ba15d22050e9f02c37cc1bce1d160caff110b8bcff130190b6a67d193f1a5913

SHA512
1fd8609cfae7dc29509e7f21d1adbc0cf83e79606627df720c8bc6af872aeef4aabfc19e8a787fe0d696cdb3ced468734ddb689f33bd5d0e853e210dfda51cad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
542459f86b25dc17ecbea6ba548eb1a3

SHA1
054c9a9d8b054316581edd46bbf70697d571d5d4

SHA256
bef1791a852cb08ce6e0bca2d1b76795d386a6ac85c0b9400b6303af0f02365a

SHA512
64f6815c39a380c887208b6ef9c294f0048702a15ebbbf44b9728f9162e8ecbec6e4e2f49ef8ec6d07078d0c00375b7824cbca7106e8e6ecea31e57d308b2bf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce9fce9910ccf789a409af6e4bffeee1

SHA1
7525954ab40a0eff2c4f7a69a6ac0374c9365405

SHA256
c302ab1fa968cec7f95d7017606aa6f4b4cfedd8a5d12831f38326b49b84fa94

SHA512
84d7d5859f296c5070497f2f1dac61c90879ce06c01736ea7a392687d85ae4cf850f715f5d890132d166aadd9ff2e977c0bf612759732c66ec8ed0cb9b245fbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f928032b968582f9bedaba6e48bd255

SHA1
39bcbd5b7b70beca7f72c8b9bc3d34fdf4dd33b7

SHA256
14518750e49b9705df53d096f01cdd9b1e48dcad193f603447e39581b0bb5045

SHA512
5efb17179109d5607dea1e67118da1b1e4177082f65a01b409d34e9828db4b4e2edbeb605f395036add94ab9eecdbf4f34d0a4e3d8d707008aa0ca46ce7d82b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54985b1bcb890121fc5e4db92c0ca1bc

SHA1
118abcc817b817af07ce9f6769d9161a0451704e

SHA256
0f4490079ce9945be630d28d530bc81c203e48339f907fac31de52e7bc447ebb

SHA512
43344049f6e5982d9a91342625f8d0e9dc455de392152fa6dd74052ce37e460c5940bea09977fefba2561d944f4816ee70b205f0a889d01c7e2191fdab94d5af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
823b0e7b2fd79f046995257fa8679621

SHA1
5a1772a5176083b5161c88fc67a940aaef1e8836

SHA256
1a24c93201338f51eb85440cc7a5274f916bc40d3969ebd98d22ca07919b77e3

SHA512
4a0677cca8a7cb3dd1df73fb794f4e0e7e8f0d1c223e9736bf261754905a15ddc622920efc436f7c40a3c85e47fca93f876fa5be31f7e60067456c71ccdfdf23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac260f0443e6ceb2066468b04e4c2b3d

SHA1
5f705a9d468c8802e9c4ad4d37f1a7f0d816dba8

SHA256
ec0dd5963fa4b450440e7d31e432e51a253a52388b21ad309e4e3aa5d1ca7f2e

SHA512
d0dff93b96ba0b2c616aa68c166304053fb4d3c46a88bef4762a936da8226eeed6ebd7681c6ffa53fd03c26cde2c8068e3f19c402ecb9e31a0a0ae875341d355

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBB56.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBC24.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit