4316400c586f66a7e2d5165ddb43d5d461ed8498df7d75c7c7271574f325a3d6

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06/10/2024, 10:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17a746c2e743650c8c45145541bad3ab_JaffaCakes118.html
Size

1KB
MD5

17a746c2e743650c8c45145541bad3ab
SHA1

2a4c05c7d9c767e7a4b6ef34e40b071f9832c8e3
SHA256

4316400c586f66a7e2d5165ddb43d5d461ed8498df7d75c7c7271574f325a3d6
SHA512

6566b49c990e002cc5c6ba7803d1ee2c164de3892d21a6d86d5203a698dbf826c9a9c68e0738cfc05e52bc82ebab8a5aaeccab9bdecc1b80485a59d9a607dff6

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434371131"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D3E0D3B1-83CA-11EF-9D9F-E67A421F41DB} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90f602aad717db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000dc7e26ad4c6e4292f8c93fd1e71b8c5c490a764ea73aa04a4e25632aae759254000000000e80000000020000200000009149c35eaf6515ee4fe965e10276623d0b33fff690c677da85c93994d8ba22b890000000bad5618dbf62f1a05b8d6b08d0ec388036228fc97a9b71352e8638e829c0aa5e248e6fcf8a9361f165dbb692cc1f846737d8a088aec9088908d8b72b18114925cc6b42f432abb5d9c805267958941af7197a2f2fd2fb603e86406525aa488c3fe8bdce027bb00c75174bf16232d358909295002862d3ee7ddcb316de0e4dcaa334d4aa80753d144006e027a910acd31e4000000033460927e2c074bd972ceb99816ef1c3b06a7da1b74284a8d7bb3fe748f44b7f1c7e6ed1a53729b07d247cbe9588f17b62ac0da4877a592f360ba80971ec959c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b8d48fc8adfa6b4a805f1a4a681aaa6f00000000020000000000106600000001000020000000a5fb297c6ed86d4893e80b5f2a5b6cde657697137f0d919de3b26dc74da2f670000000000e8000000002000020000000888b4cc6b040d60c89de0feae92646964589935c84d592455e38ad638681e51d2000000047abbfecc344048bce12e5df8104b5dad695062763349950bc476a32eda748f8400000000a185c930b2a56b8b762b0df40c5f5c7ce6d5381f127e8076672adc72744ca6eda51908507e54fbb930ecfb95c20cd9a5d47ad7e92a3541f1879e77050baf1ee	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1976	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1976	iexplore.exe
1976	iexplore.exe
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE
2316	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2316	1976	iexplore.exe	30
PID 1976 wrote to memory of 2316	1976	iexplore.exe	30
PID 1976 wrote to memory of 2316	1976	iexplore.exe	30
PID 1976 wrote to memory of 2316	1976	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\17a746c2e743650c8c45145541bad3ab_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1976 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
121b70863653a6ef0ccad34958ca5283

SHA1
5a22edd0b0a06c27af620acfb20c9767a9db7796

SHA256
db8cefc5c55de991601dbdf6a951aa0804e4fdbb075193d1749decd2f9ed8c52

SHA512
0f707e94913a22316e953434497719522054ff2d68b8a3d734863e52c83c26a3d1d5e09b18c008bc8b0932a18c40435019386e5b29d3f9f6760a92be8e2410f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b015a1620ea2bcc15a502d95ee5d0d6a

SHA1
466a646a96789e8a24543b61009b7bc708f9e69e

SHA256
ed09aaae5deeb5db360db04e8e5ad88359b43f5409890c1300e8100eabe09b66

SHA512
77a7410ba7b91b40db63871af2e04a5d9ed34a1279423d00fadf45d6f71db00070ad1df20b2aaf1a498abb1bfdeafdcc0dbff349ab38f5a5a736dd3cf613d009

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1dc9ef6427c7a96ba29c171d513133f

SHA1
08d4ce8e17ec66afe15ee2c7251da67fa4dc4689

SHA256
3a20980a1ec24de17ebfdf67bc0e2d2aa46d37f3d67c80decb9d711127e7a0a9

SHA512
f0418027154ebf13b8c01cc9793f6ce561f02717aec4346715aa57bd139c222b63e5829bfd84277bf609bfd53c95ed594ab9a7cec561b5ce657567a20f211945

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7d8265db0503ece841a89fc8d0af617

SHA1
554d967b2cda80d4f2e3afd69566e127e3cf23a7

SHA256
4971ffb04c08cde62c8336664e0525f6f3a5bea627ce3e59830bfbcb63580fe1

SHA512
62ba3a088f8f3ea0a95e776000297cc0d73210880343ab457a76b218810ab4b26646356ebcffad17708c0204c0bc6122e2ec7328d679415a1220cbc12c8b2cf8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3486212aa3510b649bf8f2674b8da9a

SHA1
315bebb8d8a81f9c4e16cd64cab13489e1da9494

SHA256
6536a7f4a83510407ae85c793097b460b21d7b8675de8c47a981d843509f43c4

SHA512
25cb408c8e56f0c9fb191217de212c96c14a55078266fd5ef6c4132dc841a2150266e31d5b1d6d0ababff809f4b7495bf3adca8551097c0906115ebeb6ca09fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d3fb3f0725ea37906d82f86c58e953b

SHA1
8910a15dd61b877ace72507b6543a4ad7666828b

SHA256
6843918c44cc054cea3b3d0122d86593e18f4396771e9a45761241a6e7e99631

SHA512
8bef81a939563c109893125de7ec5d2f052393243dcdd65d1e3514b5d5b0656311bb8c5e346e1190f88f714fd6b812359aea87bbcdd49f96a11327dc15d78d0d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4324a4f57ae7dde1dcae8fd952c70a34

SHA1
47c94929ca6e2ec199ac9bd13f42798755dfdbd5

SHA256
1bbc672b19b0885e32141299e0149b2fc2e92878eb9eb5120ce969f4cc504a39

SHA512
4e77473b8d8958e724ea2cb4056e76e92a8cbf201e6479a04fe6a24e405e2d52162fc7f1f2fe56a90fb0e3b769e1e709ff66e7b0271479129ef45bb1ea6f3a22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9774a9ab458ea448313992dbedd589b

SHA1
4f4e7cf3c35bdad5011d4c029c4fe4c3b0c6bf1f

SHA256
d6c63bfc1968d91ee54bb52ade329b7d8d25dbc940642a6d847f5bfb26bba70e

SHA512
1368e4267c73ada55e04187c110e4562e57e0b90e3d1a8e039da4fd445407a33736d428456e4d7cf7cfa93b578e805ec627bc19bb490d5f6ab901a1cdd6c0788

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98bfd7ab355c7ec51759578ea11fc841

SHA1
5a2e55c92c23d8f2923aadb8463f25a63754ca54

SHA256
dfa7f0a67bc352bd82351f9a7777efe8e8deee4394cc84533475e38b1b6c1e5d

SHA512
0d6518458ba66fc3f13ce5e7b7327170d543539b12af1e76e9466bc5dfaf9e476172f312a93435d1777d3779cfc4f30ea8387afe8900fab243f21b1519db20ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9b0e5ec07a110dc109ed0a2e2aeb913

SHA1
9b028912e1edc08536f813c9629e8886620004a0

SHA256
2f0b4c63fe4767c52cca56c6c40cdfe20640fbb7976eaa314e082e1422264860

SHA512
596739c0ba0e6af659972fac2cc9641f69c3f59d0c4b87806529122c4630aff93bfa75e6ac78afcbcbf7a04fe93269c7035115c9d4c4caa811adbc6de38e6583

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f30ce7261b7e744068227212509de948

SHA1
f7b925a89a56dcb9e36f097eddb2250dc58d5f3f

SHA256
0ea67d625b152f3cd9fea490513d8c2d47636c90ce6e83c0303b385aa1d6d2c2

SHA512
81f53c56da8a1476799d9ab8d8adae7deccb658a8ed8bd5ce213560f44eeac3961009c7897fb8717be3a0dcd90b3f4c4702fd1c17dadb83d65a67a2622fd1bc0

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC830.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC8D1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit