bc6c71d65005d7fcb67f8947948f9b672464dc3bf0453f4883510b5753d3bca2

Analysis

max time kernel
120s
max time network
128s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 07:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2d13a62daacc92c7701963a944a4f8e6_JaffaCakes118.html
Size

2KB
MD5

2d13a62daacc92c7701963a944a4f8e6
SHA1

fc66bde81bdafc4ee9018e091250d316911ffb4c
SHA256

bc6c71d65005d7fcb67f8947948f9b672464dc3bf0453f4883510b5753d3bca2
SHA512

e4696aafdb058c2fe08bc6864f31724b280415914fb0cbcef790a95327d20cf6b14447d0910b50b03142c3b75392a2283356a6be29e07dc2d1bf1bf7ba87718f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c40000000002000000000010660000000100002000000031224258ffcacf3920b14e6f8e43af85dc6567771f254bcc91a58ba3a14da44b000000000e8000000002000020000000f0bd4b7b115964cd5c66e4d4aa486374f3e79ff90e406aa2e027d5f1e8f73b06900000005eef0f84eef23bf26b264a873e9f552b83334f4bfc18130546ad14ae5e94db7a1e3f0bfffcd1d2cf22fd05eeb55f65852511cb9139df0bbade56be79e58832bd7d824c2bca99347c91dd46bb56731312328d0e97447c6e432fee550eb3c5bb3766a49f311321f03440e22af2fcd9e17fd39c6abb6c70445daec719bba078faec9afbca1f1687daba273af623437983a340000000683ffbfa612cdec6fc69f3d87d8e2167b64ee2d9a0c72b1e33e258d45a1d56d779bee0dbcc941c5c231b1912086a789363b971b7a77b721ed477b2bdbcf51306	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e07a84bc7b1adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E67BCBA1-866E-11EF-B656-D686196AC2C0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434661501"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000b3e8f15f634dfc43bfa5c3a2648d88c40000000002000000000010660000000100002000000031a653e3503734d2234f468c37d80b8da2698404e7ccb27ecfa1fd0254471f53000000000e800000000200002000000076f800f285122068a7b0baba3a5f4b1fba82ad21f397261cad3dc7a5e560be26200000009e44725a6029cec0c2201f21970c503e68bd4382f9a5b061256e4c42b19c051b40000000cc14320bf95d3f42590c4c2ac66d0b78e816a4966f59f761acd7659dd63e46d9b610af75ee3a2d967301f33ef5648cc0bc1bad5499942c6962cdd0f375d28dab	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2600	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2600	iexplore.exe
2600	iexplore.exe
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE
2308	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 2308	2600	iexplore.exe	30
PID 2600 wrote to memory of 2308	2600	iexplore.exe	30
PID 2600 wrote to memory of 2308	2600	iexplore.exe	30
PID 2600 wrote to memory of 2308	2600	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2d13a62daacc92c7701963a944a4f8e6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2600 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a06b2b6a5550e4a2b463904aa7604aa

SHA1
4424b7c6f75d5609a235cff6901036b6c3947fc6

SHA256
010179c428fa6457e1ca446bbe5c5b8727239abc2f7d651cc98371fb81b9dd43

SHA512
298c59ec1db4febdace710e9c61f7511fe9d8d13b382b6d32369c291f93429b5826faf79ce9e62f71c89dd7af560575454ea6562dd6074a7e6083dc0d42cc592

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b054b17f8dcc51025ce472b561ecf72

SHA1
fe70f511c71ea6c9a66fef7d2a270f647519a424

SHA256
f86d81de4fa20578f2b53dada28ffdfc24873853226b91f280fc28839b332cb6

SHA512
69489175f75b1a620f5efbae7a023eaa30e8ba471c521df523c981c4a6fa2f9e3b7703fc0fbb4556b857920c04e40602ef3e5765b86897dfa80b174e8fac8171

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d38b2b0e6a24b9b6dcdf6eabe914c7d

SHA1
afc789db17a0c3f91a96366d75dbfce003e905fa

SHA256
bba00905748a67fcf626e6308d363a7003fd3ede674e21b4cb9fd15acae2e2e0

SHA512
5b18d46de18f9438b5bfe1b0005d37617e39a187b0acb9f74a5610531baffd564562ebd61a41dfb4a8d9b962482146618b6ea58623d103945b7b97c01b852b57

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45385015b57c6496320321dc4af460cf

SHA1
1d8e0ecaec7d1515cade5108821a25e124a79ecb

SHA256
41822303cfebb77acfc30e64f08288115de8fb85dd4af9f0de49f6815140ee41

SHA512
7d19774b2dcde59f56f7aa49b75816098f773f7c1ce823cc3ca0eaf41c94563ae2b464a2ad5adbe0574f73836e22f96fccb2c4f0ac20581fdd991b1c08607b31

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1da3f2b35f10f8564fcc355e180d62d2

SHA1
f2022715de0af4764d246178074fbcb22b952a80

SHA256
84d33f872851ccbf3f5873e989af2ca95c6e584d49332214d36384762ff238f5

SHA512
928c47c3be2de5e84b2a0418c524a4af0de070ef46ad095ede1838cf4d2ed9193598466988c1b9f7227a0e039b80e5d23fb103c7a2c5a08f9177abd5ad6db818

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b78a1fa93fb031335208eed9b219dd81

SHA1
56e447a77cc5e9d43b67f3db07b0b9895754a12a

SHA256
22507c254e17b9e91fe47ad954c0216ee1bdc9cf083c5f1d0618eaf0e3255c92

SHA512
cf933767579433ed0b230b72f1fff17757bd021dfd918052d0929aab945cadb15e95167266c6fa5a29f8676de3d2dbe49218dfe3dd64296f2f8a26ad6275e834

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
157fb3c2fe6ace50883cf74bf70d5b27

SHA1
789d3cdc5364e321b2d6a58705556c5d832fecc0

SHA256
a64ad596f9540486eb71c7b3784a3d184f09de44fc1888b9af7dc0509e39d52b

SHA512
d392e6f2e541cdec6369f200f007a01bf42e325e8159340a64936464f851d1a925a27365408839e8b727abee323cd6c6dcb15bccc24675ab5c4aeea429ad09b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8f9389ffc1cbaba624e3d5c42688c72

SHA1
3f5d10e244fb51b924afc34df65ba6e17b17a016

SHA256
648a28dbf402b25051e773c9ddb8693194b3eb9db2045e566fb7a43b5df68f81

SHA512
3ad4ad16c5047b8a7e115aaf4812f810e1e288cd96de42f2f1e284fd65cf78f4de21e1665c48898f1c3db96234134480276863d4f0f4677018db82c275578fb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a7fde26b4cd6a6852a7ba93aa77e2a3d

SHA1
c4e7fc2722168743e0eb22bd69f4c6373c7c3d29

SHA256
3478bb1e7da99621e7dfb1882365a97d07d61c92d06a73df622631f08555a639

SHA512
117d61ef6087ee023f73ef90f6f9e2005637deffcac09dab6be1e8d239495cbb5a5ac1b2f7703ea7040b60fe32e707be40a83bd3b6f4095e9d9ee4972e8e4e81

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
306ea022ee5e87e22544c3f2041cbe23

SHA1
2d2e2e0b1b80919c7a6e550c13d5dea24080f1b8

SHA256
38c70d0ee4e6967a7f402a3ea78d0644c6e6636c6fdc61e283b5b423d4e3e028

SHA512
e7f9f1e4ac640fb324b0705a40dcf6cf1e56ed66e558b7f2ff218a610cd00950953fd80ad9eeb6d65b8c2b52d4d42e56087441eacce72d06a55988f58849b29f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c741780b87af89f75e323c1cd73e8019

SHA1
1a934ca3d6597394ba1e2ae0f30969efce858fc7

SHA256
55352bbbcaf74e1d941300e6e912215283f8df6db89cab72532c8178b56a4f7e

SHA512
14bd92d4f56771c643a973a176ed1014ce1732ee35a15d68a16f0d6a893b2e3fed040983d50071c72c91ee72462406b6c1fd8292dc41d76245c50070c6808a16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3fd6c40d98d42588e0622970e387f20d

SHA1
45445aae1cc75ec1aa6e1462e388d8f2de51b739

SHA256
49270801c82953f1a986e99ed68f5dcd6dc4b590cc876273966d2e1f17ac10fa

SHA512
7fa61f8276e7d0da9ceb5d52a613492ab24ed48605c6f583cf363b5160fea57391dad3bac223908a73ca9455a6e328c4232f4412b419322a63db80d8835259be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12de80b1760989aa7382fe68ed7295a9

SHA1
32f7c6a688c3c2b97b2eb6dd9d434cdf92ab55fb

SHA256
e9db037219377efce84e674f7e0bc17c51894916f5fdf0a9a1c2db09aa7975ae

SHA512
58db2a3c9b8278a3439ec6c14f0e04f4e2568627d8cb271bfea656f70d68b41d3a3497fb5901adeec931ecf369eb6932ce35be776c22d423d0be96ec936a7ecb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b295146120335806dca956d1d398e283

SHA1
9711d1da253d672c52618ee39ab4cf40bed78242

SHA256
aaad321861317ff1feb44d4b5246ceb284198ead6a0d5d7251f2c22eb145ed7c

SHA512
1c962dc01ca6e38279d1fe4d50d7646797898afdb1a359015dc2fc392156acf4d35fc74e795f5f5df762fbed5471217330449f23c17f16cb62af6002da7d5536

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d9be51549713f044b817b86a24d07c69

SHA1
e1a22666293f9a5c14a9e1390e060b3f90757d6d

SHA256
b72e0d3b01e2a8914c5ab05f27948dd13dfee80179f80051ff0f5ef8f1fca442

SHA512
a3a275b8b64c1abbd383cec5d7dcd12dd32a195e186b70313de9ec61beb36bc9af89e316b8ab43e027f024f01dc0a4158b2e5fd7ca7192a7981b5debc0ab27b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD09B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD0BD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit