29071d84cbf2e2681b2bd53ae23a463da02439394274be821b693e3e9fdadaba

Analysis

max time kernel
136s
max time network
141s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 19:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4199447a3d24f4a741f9cba42f913d51_JaffaCakes118.html
Size

25KB
MD5

4199447a3d24f4a741f9cba42f913d51
SHA1

156b1a603bfcac280bc60d291c2422561932ce23
SHA256

29071d84cbf2e2681b2bd53ae23a463da02439394274be821b693e3e9fdadaba
SHA512

1f317fe13dc65fce5fec9e62c6e91311f57b164a35be405e8d01c0f98ab58322deab95d8169470dda0e12ca55858d7988cf0eebe8b2a98fc3fa5ad19e7aa08a5
SSDEEP

384:SknnYrnKFk1iB5cyhzsbruQgAAuRcIIy3I0CRRUuYdhlhthdEzjy:SDaj1b2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e78a69453f00554b9c7935775bae7b9600000000020000000000106600000001000020000000b2959a552e13983d8e286f36dde67672e357241310de5613eb31d53c70f24691000000000e80000000020000200000009a07faeef4b30b4f150ece428fffea298e8ffbf68c10b8c36b756443a8b0f3d5200000006ddf1b540c1abbe36814680d047691ed48986638d1e0210e11f4785270ed38844000000038d2609862033a52b3d1ddf0395195aad5cd4fa8d0ccd21f0e9ba0b81e602c17ba95e96946d15c919d94a19f22c1f3169c73a4625a27a9ab2aa294bfb3c30707	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e78a69453f00554b9c7935775bae7b9600000000020000000000106600000001000020000000b47f5cf3314aa4f9dcbe2ad79ab4e8c06b45adb03d818876143496ad9251cbc5000000000e800000000200002000000023075f9966c299644c6bb8c2e63f2b7728537655283e0803591d849ad71d6bb790000000f4afb1b6b3f92b962a6576120f105f0eb5cdc01b730481ccf05a94f3053671e282c77cfa1e1a1050017075834040046ab13ad93a7072541e50337e92c90d57f7b97ff606c36bbbfbdcbdb75f9a1760d935f7bf00bfbc9bd5706f56abc468442f8c21dc0b875cd0cc622457942f1e8afe8ee99f2ea6cb32e8b90a3ef9fae546476e0f154a4f74f90d4f9930f0c1a7167240000000f6afd733aff9845347a382ec9f1bbb21647f099aca5ede048c23ed133345b7f797b51e036f76c65cfb2e1a7cb5c3c281cc0d494a7658fe9b0cafcf7c4e5778af	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435008689"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{421656D1-8997-11EF-ACA8-72B5DC1A84E6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30b83e17a41ddb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2039016743-699959520-214465309-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2760	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2760	iexplore.exe
2760	iexplore.exe
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 2736	2760	iexplore.exe	30
PID 2760 wrote to memory of 2736	2760	iexplore.exe	30
PID 2760 wrote to memory of 2736	2760	iexplore.exe	30
PID 2760 wrote to memory of 2736	2760	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\4199447a3d24f4a741f9cba42f913d51_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2760
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2760 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13a36cd31b2b09defb256e53b0b4c2c3

SHA1
8a71da5ee902afbb1104d01ff93d2ffbceee8a73

SHA256
c1efff57eaf95b46d9e29cdd15d91d39e77df3f0742fb0dfa2e226bfdc8d421d

SHA512
fc1ada680d82c2e18bda15fcc8c670c989472759b0420dc93eb5c33782364fe2eb65215327bcfc3d7e7ed4a861bf452320f6ab2784c0ab531f1560973900b384

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0eda71fa60e276bbe5ecd70bc2d0e30e

SHA1
c3e97bb2a0f66a225ac64cd3a1529bf61b958fdd

SHA256
82c82648aaf03af1e6e364c6674c05d74f70cd1671ceca1902d321c32a7b9940

SHA512
ea5759788c092ad8e170bfffe7746554edfe3402d457deeda432a9e3d54057ee3569655948393a43d3ed1c2548e0bb936516396178fc9d6ca07e10e156386032

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08016c65e376d7b08eb45aed9f0a6f7a

SHA1
3e3cbfc0926de8407b661487097c4f809805651a

SHA256
5eba9e18838ab35db83b61c7c23e61c356632c80e2f3e7468d9ce282dc2ffeb2

SHA512
f97afb4fdbe61cf2f7161e187ef6ec41b2415c69204f0a2bfc4f31182591578b7b6860ae0d2a248664b9f64c44b6bb72f4781febbb9a29802c01b34af83be3cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37bc9fb015d20df3dac86076b1a60ad0

SHA1
6d79feb90043bc4f2dc30734d6b3288dcbb4b4c0

SHA256
7db72012696c95ba71f5560d3137d4e932d1c4060bf15b03b90bdfff2a5bad9a

SHA512
9358ff0af9f236da8e038adc30897434bd1f3b8e19f8cc3f776afa7f2380a3512033fefd7ea605c95088f510eb8db6fdda72b5647a0c96655e483ec2b253b301

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e415c30750cd74966bb6c80a5c24956d

SHA1
30cea1f2872e6b57e8ead801bd15a56828a9fa81

SHA256
ec93fb8ec45e04f932a9891380a73518649b48c5472ce535c772a82a5b127bf6

SHA512
bd241d1ceefebfe19575cfd2e8970590f67fde245fa9fc19485a0a0f6196c7f5006861bebdade341cb6d788ef0db5c0830aff116cda8ab5b01c93c746f52bf70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
969c45efb730b866562f911492d1d3e3

SHA1
6e1ac4ca34fd0b5b8ffbe1884d05172a3f5a62e8

SHA256
33d302a5268bf84d1d88054c4bf724f10747f673d62f6f435924ff579789bd86

SHA512
53975b50c56b624922b4ab6b1da1b24410ae91699e8c74564533dfbcd6aa6a55ed8d7e0f4fa408d0672e2e5dcf64a2b8ec0604d8b356d82a1a13b886888da827

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d05143101eec2c7deaff524e9098b23d

SHA1
1673fc0a08ac59e7d5b0ad1e27142dae863270c3

SHA256
b7cb9ac557565642866fbddb374fde818317e91c183bdae160e6b200c9cbab1b

SHA512
745f2c408602a3a2f12ded46285e53288de45ccf0ca7a8350d540ba6e6facab503f1c9f10e796b8768f8d63e5a81d6a932db37993943a5361be35d715f587fa2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a645f62190b1ad119361b99f4e86cbb

SHA1
272ec8296c7c672e8e797edae17e1e5cb7e708cc

SHA256
5b8c0420ddf46c7b8854f9dbca2b321f7d38edd9a017edf6b30a0dccd81d587e

SHA512
8c273a4e31e342b50cc97b2b8452d95193137bfc66159c36187570e8b9d685ed8cc77029a92a84c91b4c4ecd0e9186616d5717f00962f4188815d6b3c13d4e5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d24acf1df30cef8ab6a03e1376bdc1b2

SHA1
59e5ae183661cb7879613d6179c8f2c2b0c5a81f

SHA256
489af62e0388dffcfd52e1e0cd0ebf587edef13a5beb4c320ae9276a4fe66e3d

SHA512
822f53a8fdfda16e8d14f3f345af003a2e414c8f1d23580f4a3734e283eae3b2677ad3333cdbb2c88afe65958f7e27bfb32ed7fbc2bf6a46a0d8135af4351799

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94ea3f5b6c0308d2563ed38a94df7ce9

SHA1
e7af9e78dfc1359be89b278532b3bb9bf820c9ac

SHA256
608e56966adc66bf58f52a1f0c8231cc0926911e4265ef13ffc4714223ff0e7f

SHA512
39f94ed7e57cafffd5e503dc8479365c020e2b88454b51efb6d22c352ba4e1dda5d5c4bb7a183cc9115523595d48716d0fdc298f86e341e2b32c3ac60ba4a8f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3bd4cc90c3e8745c4c1d85bfcd564dc

SHA1
868aa5c7a69052e5c6304823e3bfee59cc9d6674

SHA256
11a49d9369ff4a02d6493bced2f9ef54ff6e7facb5f3dcfc069bdf825610e943

SHA512
54b6fdafb4605b80ce322246737e4c8657025cc156e7f1b203d3cf525d0d293afecf9475b40762340a092e4eb3378fc0b762402dea92a5a231763a16f9ce0567

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65965a7d023e69c64ab5e56f95d7d0e2

SHA1
71a02c7ecad1ca7c717736ef9e93d5ccc1eeae9c

SHA256
5dc7ec465d43cff97a31f13fbddd86224f4bb84f7f0a7c95a68bae2097e1761b

SHA512
e1e2c2087d269d9a8a8c131c0fd7c95a322dd7bf04ac8bc0437dfbaab901a67979eac6db2a48b063cac4e4cdc54c7ab5f5da0af432c3c26119a113628bae6b2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72a22650f7dc12d5e1d8fbd44cfc8b73

SHA1
34cf71331980c071fa29dbec57d7b5e2033990e5

SHA256
548790e1fd563a498a69e8de2be90ae6bcdfa0b0635789f6641bdd2a3cb58904

SHA512
1773e26dfa250be4e7c394df3bc8df3b0bf76d953059b9aac818ee72fb70cc8a6238893de8635393e46dbed9e3ea11e57443d8da9d717b13460c1d8ea9f0b3c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6184.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6271.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit