a5a33863004396feb3894ecd490ab985a4d27c9b97e2b95599fe34a35d7a1064

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/10/2024, 20:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

24db6b237b8529d201b5ceb129296213_JaffaCakes118.html
Size

3KB
MD5

24db6b237b8529d201b5ceb129296213
SHA1

59ab7d291c49e2c2cd55ff64399bf4d3a3842245
SHA256

a5a33863004396feb3894ecd490ab985a4d27c9b97e2b95599fe34a35d7a1064
SHA512

263c91e1db5b831328f6b5692602d1a17caf2211e97d2703696c973827f7110baf4bbc8a4c62772662dc0d5e0631dcbe5e94652a1a937da8724324412947359d

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434600303"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b075173eed19db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d90700000000020000000000106600000001000020000000d3be595fccf7fb05ff4c58bda6b6b7ebe51daf023c2e92fd1e97d90f2a880335000000000e80000000020000200000004a2f86cecc83794bca44bba458f9762949b69f5e81bb4708de5f5ac083589fed900000007e31ce128cffe72d63ac8fe3f6685603c6a61148fee3f5c221c523cae6aba0bf8e65c053afd8b26e6b788f30390507d440dc90c63b71e6c2d3de53a4291e6ea7a40eb6ebd138da82e353d4f45fa28fba8ca2da47fbe6088fca38923b4c64f4a84df1906c6c89bb722142244f610818e60143c2e66d90887310468130c7b32d7a422fc470dbf12f011b62345c0443d6ae40000000d2e0949354c26bfc9f4b3c7399bc6b5c2412fdd5bc9f670d6964c11b210c90dd2ec21c4c0977e6cce034ddb3c2a0b381609f8f00c2217ab40a6f02a141222403	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d793ad506ece624c80bd99362738d9070000000002000000000010660000000100002000000002b3ff0df88a6bf0cdc00275ab6a35194e9ed140fa101b85f5652896aac77a5c000000000e80000000020000200000003678891ca14c030f38e4a89c74e3bb9691d64f9dbcd8763ace49696cbf269c1b20000000bf965d514af337c19939e46b9d1141ce03f8d2b5ff713e84685a5678cccb103340000000bc8bd0511a46164deab09371e893dbfc5d2f49acf64170db5c3814b50ba85c9d66b1be49e1aae09bcbd84323a367474b37c9d2bfbd2b6f5e18cb8a1ce6b0d6ff	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{699B03F1-85E0-11EF-A7E8-7ED3796B1EC0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2544	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2544	iexplore.exe
2544	iexplore.exe
1712	IEXPLORE.EXE
1712	IEXPLORE.EXE
1712	IEXPLORE.EXE
1712	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 1712	2544	iexplore.exe	30
PID 2544 wrote to memory of 1712	2544	iexplore.exe	30
PID 2544 wrote to memory of 1712	2544	iexplore.exe	30
PID 2544 wrote to memory of 1712	2544	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\24db6b237b8529d201b5ceb129296213_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2544 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d13249bf318a461bbafbb4d1be532246

SHA1
4b2a088edf1350e7b8fde9349ec7f9dfc0a4b30f

SHA256
0b021526ce76bfc43c0b7af31c72f741761e6fbc9049c8408d5e0b916f581130

SHA512
fb4ccb4d25b2f1895899bc3256bf7c3b09f6a0503f8b0a6fd4feb3963a6153562ad4c00b195b51fd332030cc2256f01c0fa4bddd58256b1d05e56f3f8b2fdbcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17069c1f5363ca0d4b6062262abbaec6

SHA1
7bcf19d12b17a9bf2465fc9979a3aef96882b30f

SHA256
d7bcbb77e80de95d43996b7e91d979607ef05bac46d44b831cd39c33051ea9e8

SHA512
b2dc440d1aa46919133a085df102d48d8259c05cedde028089de956ce37c6ac5dffc80361c9a66a75d9b650895faa15d277053c9954fe154de79b6f527ed77d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ddc57cd206f48a4d8658fa9d40bcff76

SHA1
9ea6fa4e8cb7b466644dfbca62e1bf7f69f37f6d

SHA256
b2d58e0ded756cbc0a7aec11e9b0d939dc9b75ef6eecbc1c5c1a3fe3642de14e

SHA512
b2b156f9efd93f609508b062507a4b5fff5a1b4017a9fb4cac98c58b62205e4cdd637c4f9f0395a6473524ea199b739290d1aea218bed12f6e836915e66b9e4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e90cbb6a269c2cde6c5d3cb7ac01900

SHA1
4226788dc98b44b1547f4430bff989df131eb2a3

SHA256
863f2d29ce33a087db80094531ffeaa51dd2141a68be720dc89216b1b547f983

SHA512
d53381c9427f6af1216c55ab5ba362e4e683af88255653d662c0f1f8ce6fe02343d566e1b64639bb07f391c5a02314f5977d6da65539a8257442cd5f4e4f249c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec2c396ac36eaf08e8c972d3b00a5609

SHA1
7207cbc67be3743c8d589b7619a3680c01a8ff92

SHA256
d9c76b3a2337dbf708a9f083388990e16e49e02b253e8573b37eddc867299bd7

SHA512
76da2d40a2ca89e9c801beb55325866c7a2401842616bfc7a4feeb4c1694b701cd66defc56360da8ae9c04882e91ee642dd7bfeed5243030dc4acec893c2d0d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
11e096ccadb644b4d309d492725083cb

SHA1
974e5a968cf6a813ffd1c6e2db7a18ea6430f0e2

SHA256
1100f262824bf38202c4dde49211e9e5ec196b0dd1c18945bf66858c2358703e

SHA512
3596da51ba39dead5d59b3f3d7da2a22be6258796780aab54036680855258d504f9f197c0f8b55d49179d26dd7080bcb2cecc3a1572ca80dff8179d545139018

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dff22105307bf7a2acd85b52046e8557

SHA1
37c16d849f9f2d39529adf7ee07c359aac0638ca

SHA256
cd3ddb038e6806187081f7f054492c4edc275ef4693cbeda90798ecf85810693

SHA512
457f768bfc05e4b91b94a1db00dff53aafa011babc42c8ef691dd0eda41b25f4aabf512b6ce5f425e1e75f94fba6a35d370acf93f9d1fb5507a4e6c5f29467ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2aba8a3a8a1782c5ee5dc37107e3a691

SHA1
21b8668bb305245334ee4be75f0dcceb536c642a

SHA256
e82c65e2eb964b5184a51423f4f6095ee998f67baefab390d9912a5d73781a06

SHA512
94c2d9223d7d7f8c0c6a676f6cb204dc334f6c9df940c060a45c09c9b47aa517432aa95c5c41dbf87c542c756e5a3ca32f111ff1f163bb82c8097a2c12811d8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF06A.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar1F99.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit