d347ecdf8f231bd759cbb3cf8c236fbb9ea488c94efa0dcf8a84ae5470ba7c9c

Analysis

max time kernel
147s
max time network
141s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09-10-2024 04:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2afa6c1337cc20f4115018cd14e90b96_JaffaCakes118.html
Size

1001B
MD5

2afa6c1337cc20f4115018cd14e90b96
SHA1

080247c986c5ec8f07e58eef213669f39c3c8520
SHA256

d347ecdf8f231bd759cbb3cf8c236fbb9ea488c94efa0dcf8a84ae5470ba7c9c
SHA512

1c4fe8b2d157b03fd16c321829098c9d48af11231c415a74ecf1c879eb445e7e34b213fe88c47dee3b233e7d40634e2af8f10631cb4ad33ea199e63e1477c27b

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0403da1551adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CCBC3B31-8648-11EF-B190-DEC97E11E4FF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434645151"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000153d3fcb36ac0b4da382c17901c9b3420000000002000000000010660000000100002000000081fea42e553fe3d0944af35d3e7ee8fbbdb9f274acd49928f38d968e4b81267c000000000e800000000200002000000050eeb29ea6ecf5e26f19bdbd33a465677f55c70269b9ea9888cbfaa4354c761490000000da6ac888c9ab906dbce856b9c210def26603e7469bdfaa970da1eb01de3f44cb0ec09159a93b4780e22291aa1a6d075fd53dbfc10cb3a55c30c4b1b114070d05611d2af03f1166fa16a826de854cdb71b33db71bd5e9d5e8ab8ebe563148268076ed8c6b380687d5f246adc3215dd00971121d527842db61119ead951988952993f3249167170eabcb40116803ce395240000000f1602c783a8437ca07ba450031c340edc3325ea8331766e5ba17b79f10eb483b3ad5186a5241f954073fbcd7cad52306ab383152829441587b2c6d231442ebe6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000153d3fcb36ac0b4da382c17901c9b3420000000002000000000010660000000100002000000022b052b1385f5cc33907496c2f71962fbe817c749dfe918711a07bee60572783000000000e8000000002000020000000c48a694a8ac6f150eb9dd1d909190c6a0e10b497cc79384d94f173f525bb2ced20000000aabb6fdfb67716836529d2a98853a301850efd594e22b2fbf010c2dfea5b052540000000ee8ada839e307f1ab2810aa45f93cf188ff01ab9d2ea3d3b672216088d9bc624f1a43c506da1c6d210cc831daab6b2cf9f7c605312ac1f7a1d0d96a097430be8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
780	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
780	iexplore.exe
780	iexplore.exe
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE
1724	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 1724	780	iexplore.exe	31
PID 780 wrote to memory of 1724	780	iexplore.exe	31
PID 780 wrote to memory of 1724	780	iexplore.exe	31
PID 780 wrote to memory of 1724	780	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2afa6c1337cc20f4115018cd14e90b96_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:780
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:780 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28c0355c2d2b142d1ddd692c35427f36

SHA1
80dd3d821ace3e24d521f336bea4d954df0d3e53

SHA256
f5b491d431bdd05a21356d98ba208a551a7ce2ca4b999dfde1866969d61f96b4

SHA512
a11771dac92384f82b019a4b0bbecfc4fb3f0e75153dad789047703492c2e6ff030cc61ee3ee73ec4718c35d4212758d4eff74e333b315ec31498e0d12767d95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b6963547f3c32373dff9f9cfda9befd6

SHA1
e901f9d027c7b682971c8b07a5163092d7a62b7a

SHA256
9165ab107e642574cc5d743ef0da096ff374a7d1497d7d0189514161edd1efbf

SHA512
9d7a2de319e0a054410082eec63d52631fcfba89daf5bb7eec61deb9a07e5e589814604cc77446d64f5d82656fd603a2ea8ad9b6ce0aca431d729c243f79d605

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f210f7e0055ffdfa8687a995ead2d516

SHA1
47e99ef9579999de04042f909dd1448f9e122950

SHA256
528b8502df9daae314e9636f49211c2aa33edab951595fdb2113b742dcdbd547

SHA512
9bad88ef1af1b40426e1204c81bd9c85bc7c60d27efa089bc29cf58e25fca1de14ea1f9d456bf43ff01da3702bde3215298f8712e30ed0e52907648e0fc8f275

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27ea306fce4c144f2ec5ca413bec6341

SHA1
2f8cdff03536bd6a62dbca993d08c770a5669d06

SHA256
303b2c73614541f116760c904c978190d8cb6262bafaf80fe2bb39ef3eb538f8

SHA512
3da6bdc908e135761d55e7b44899a5d052b0aa21e4e578b5ef707fe31ca16b37f3bf0026f1df14961100fa41902e56df3f5f8710db0921e2422f43b41420a5a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f6feec47969163b520f2549069b0e7e

SHA1
b4095059ba28ddf864bbfef31bf3f643c3197f53

SHA256
9c622716d3624f9a20dd9a9d104bafb27491fab6a4ab861d8d0c52b7a45df994

SHA512
bde68947a5d57674970760a0ed60b09319532e3668775ea6d556b1564e58dc7e12d345f7721262981aa9ca165c3447f029df2675297b3bb69cfbeef7c57fb8c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99cb554b77add2954e34efdcc58776df

SHA1
c76b3b8181564821c6d9af846d268233f4ca5c60

SHA256
9dfd9a3b12384a4468c102c334fbb520d0b85a150c6e51d5b4094072d5ba6479

SHA512
88664092b1c2e720d40bfaae2978ee47dfcc9f6ec017b7c0c08131c9f0b575a794301b9b43536b0782815bca61fb7fcaef93ba4651b5adb6fa1c1b7d5dfc16ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99dfc80569af7172965d9074486e2ccd

SHA1
a00c0529501188f361f25a647834adeca2a3098a

SHA256
06aaac262141e2336e1df77af38881e0230bbe97145dc94cd0c1a5e15d0f16a1

SHA512
6b6b7b7a8fd502eb1c829252da7f8fe866e40f94e7563a52e8c086a4b971eb9b187d6d9cde48fb0790e5e742f96ae8dbb222f41743193818e75af169528cae7b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d91d20f9d856e52b6657bd293a15988c

SHA1
00d65fe64abfa97ad176e0e682ec504c3e14bce0

SHA256
12d998ce23275338241e13eb3ea556438091930b813f687857708237a525575a

SHA512
950300ae72c3d3b02a3e4043340a0a1de55d834769742097d6aa3f0c3a97a4c67ba24155c36aa74efe22013ba51741d416fc2cb23d10ce74d91fd9cd3be9bc1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25d03147e42d9b9508500be06dee8a9e

SHA1
eeaf82c5126dd231b841e11e78cef6ce55d6db88

SHA256
3b931da56b64d9b668e573c502e31c89a6647248d0dd6a581c07d39cec6bd028

SHA512
907f1c033e7e465aba543c3801d85d5abb1b843b49ad955333b6161604fa6ae83583de56a4f187d34d72941d0c773d38d166bbf0d9e4e7c410381191da7385d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2c75d0ca3a7a85fb43bea8486f4c01b

SHA1
e5769e3d4949bf4c1f328b3826b7895375386f06

SHA256
683d4aeb36e552db1bb9e87a5fc205b77aadc3703a8f85259a4c892857949f84

SHA512
30d0b5164868f2065428e1e1944269b56ebd6072f67271a4714061200b25340e7b5ac5c55788e0fde8f4d2cd89ffed2a64c35df2dd54e7d678ccf8465c342b44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92aec107a062d571d88c2da9bed5ab1d

SHA1
89fd45ccda7c14e72a1735d4f69b11b06429dc48

SHA256
0131d906a3e046c087e8b7402a23553bd09d03984cf6a690cea544e587e6c020

SHA512
942ff49352b6dd2ed3abb57b9be0108acfcb81916b4872e6af9ff1ddf620d783df70f46b9c705156ea736891e4d543bf69e8b410a89014d94fb4b250a53eb8ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d3b04feec3dbeb958ec5e94213fdd2d

SHA1
604641934933e83423967a67bd3490ee792d3c02

SHA256
9541c33c972cb0927b83e03d9a7540cc32f95fe9b46779223e2631a878ba912b

SHA512
106451fafceac11765eb2ab9da2a6daad2344abad7c4befe6ad4dfe66e7525af339ff7890d6f3a478b0355c368bd7c5a909293108cfff65a1e4903dd0f1b2936

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9d6953ba22fd21c4ef1f6f398daec5b

SHA1
e7de1478afad51db090358a50be3574fb31f0ed0

SHA256
346852fb4e3d0c9382a9955b49aa5bb66239fc2ef2c560d8ae0192c4c38a6670

SHA512
e043ad87c888765bb15226147cd1c38621a0afb70839ee3407676ce6f3f97d1c706dae742d45ac772d35545fee644beed38050653001e568f972d5e2e2c245b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bdcbe51ac7d8ee5722f68ad9234d7123

SHA1
1e6f45534bfaf309a2aebd3df717b7befdc3b8bf

SHA256
9f325283315959904e563d61665bd09cac7fc846183a6a2e1c172d737eb420e6

SHA512
1b7430c7ba315935072128a44fe99d1d31fa22bf9e2f2fca9ce9da8b503afd92c0687787b25ed3a4f0e2e2ddc79dbc0391cf2fc98d942b98c63618cbe499d6cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97e38f526fe118a75d1e86f6a0468d4c

SHA1
069443a954c7a44a9f60a2b80e4d4849b853c915

SHA256
ed802ec5abffe50d93a50e3f7d52910ba3f2901732c49f202b56ed1d69457c02

SHA512
0ab2eb03ea52695576b2260a586f29fee672563babe327126d1d61f7ce83bf1a33b39f41b35e7fc0041152126a114f320b5080c03a18a0ea56a6063c9cce769c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
409a50d80fc5275074a3db0a3b0e46ec

SHA1
224bf0004af4fd9858ac8a442f24845af0607d38

SHA256
4dc3b3cfcc59a839d962f47d0dabcc93b0954cf515f9f25907d4607bd0766681

SHA512
9d2d31f71c95863c0349b3619791bc3940d234e4ee4fc26e6be131a38b7ea90be3cf0248f149ad4c0e5615f5c529dfbf6a08f127d23ebbb1bc2c8c4f545460b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd7e8f4eededbc201bd5e9a3204faf48

SHA1
ac11664103277143ac0a801619d2788efc53f96b

SHA256
85ec545747fa601586f97dbaad432e5e2f5b48eae913f73e4c99b26ceaa1418a

SHA512
f385e4f7dc8ff749c32e30bb5dde171cbff4d82dfce33b9199004a11c7fb5559a0a007d96ff0992e9402ec7f187394a97494fd394a01c433d880986a4c8ebe37

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFC5C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFCEB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit