e9084c5626da6503af6d6b083bb1e54c1386b007362bfc6b87f78aed73fdf551

Analysis

max time kernel
138s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 16:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43120a3c4c46cd883566c65508579dbd_JaffaCakes118.html
Size

140KB
MD5

43120a3c4c46cd883566c65508579dbd
SHA1

fc13d75919ecabfe3ed4ed185bebee480475760b
SHA256

e9084c5626da6503af6d6b083bb1e54c1386b007362bfc6b87f78aed73fdf551
SHA512

928330ca971865ae944eafbdc90fb71f557877b928c26a688b2c6cdca5594b78772f74c365231907330bb5703eff90b31b595299bb0e98582e908a3dc55adcc0
SSDEEP

1536:S8x97sBQ6T2ig6QCzwXZwl1GbyLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1Ul:S8xmUyfkMY+BES09JXAnyrZalI+YQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{33C80681-8A48-11EF-B909-C60424AAF5E1} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd300000000020000000000106600000001000020000000730d9ab61b9d86c5135234e856c6f98f2e972b6037197b3bc11e5ca4bd83d7d0000000000e80000000020000200000004da016dd62c16833b018d824b5e83c993b27864b6060c5d15e3c1df9682dc66d900000004578f2a713b5495eae592d37b63a4152f96db627cc9d06e9ffd41d1221e6ebdfb890abed819d825a68efa4132b3fd1350e4ddb7e3d24dd190336beda47686bf6a2526b362983faa5a0cb208e6511c084b5719f39e6130c738ea4e40757ed945a94f0d1061d6570c68a6fd7f47d01b1bab9298bfd625b474868460f36ba8e60c27c0d3c5b5ee642f4c40365790a52dfa84000000019d755d2f310f72aef1169f33c2efd5b2feac225255a8d6bcc5caf53b1732f678b3b3fca2ab78b469076271e7b71b7664e3d5fcbfec281033c2f69a603d97c39	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "435084686"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000953bd8210872ea40aad5946cc0771cd30000000002000000000010660000000100002000000097970c169293c7096dab88422d8ce15db49f2a7cc24b9b13612abcece8324988000000000e8000000002000020000000cb0be9f4b15f561a6904e11d22f0eea92ca19ac7a054b1bff055a2802747879d20000000ea27a0e1f77b1945e780a449141fb518b6c0a0e8c1c3142a8db5525709aa52634000000098c9d850f9ae7462f21a88b0971cdcb733b4e813777dc4eb7b5e52e14b109100be33acd73c9f2864017ab4ad177ac0f68e020bd9fd6711f5da1b49f069498eba	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 604b8e48551edb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2112	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2112	iexplore.exe
2112	iexplore.exe
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE
2352	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2352	2112	iexplore.exe	30
PID 2112 wrote to memory of 2352	2112	iexplore.exe	30
PID 2112 wrote to memory of 2352	2112	iexplore.exe	30
PID 2112 wrote to memory of 2352	2112	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\43120a3c4c46cd883566c65508579dbd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5d6cc79ddc24a1f7bbd5917df64f629

SHA1
e3c7f1a5602d95d0d52bcd4d4313678fce1e6a9a

SHA256
bebfe895c739b7d5bf892ba5ed82f0cdef8c0455b984384dd761eacb84c44782

SHA512
7fe5b7912b9e9b25125dab0177cdfd4f6be74cf0727e214a4533530d888b2ff4de119c5c8ee352d788bbda6a053bcb6d083ce77ae78c374dc0b164fd0141a649

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08ab1230ed9969ccb69c3c66f940c912

SHA1
e576170806273c8a5f2db229fcfc9261b8ab3b8d

SHA256
1c0ef9c663c87b48560196748f0d57105e91bf9f943f35a0bbfa1228ce48121c

SHA512
9b35052a53d6d3e1dd5e986d73bbea182dba02924ca8bc4b092f8dc0a8f718d4b7f2be4417ded44fdefe89d266e9e0213e1f1d59448d5fe6365520c7fa9c79f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4489f2717be87ce21d97dbc5e7e4bd5

SHA1
bd79d1aba23e75a484ad6c760ad56cb01d5cd759

SHA256
55b758824b0a12a7e427eb2eb80dc97c0cb81b26929999f5d348e3659fae74ad

SHA512
47bedf0a63b75da20d983dbcf6868cbdc1f20ea93cb7e731793425841e798fc906ef16221a71494c2d5567b7b1722b9e9e848d5b72f2886a4180bd110f5e3d27

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0d0fe252abccd7cef6a6b03828fafc31

SHA1
0304598d5daf83433474bc414a02df3b228f9847

SHA256
20f703ba8d6a20a0c57c6b858264140bfc4d0838d867a3ad7702b7edb562fa79

SHA512
036e70f9457b2e5dc3d8fccf3d87a26bf963907bcbcfdd649d46b3838554ccf0ee1b5394cd8741248adc3e14470c75c6bfca6095255405645f7737540d01eab1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5b6af32174958229e7bb6ec699fa533

SHA1
fe397daecf43aaea47151104e5077e563002dfa6

SHA256
797ae741db1b8fa604f2f1d8ba6835795a3ae8d697ffa5db622017d7d45ee10d

SHA512
4156e94d137498672aa2f8ea87280ed33340d371bcc0474df9f20983c623e2ea7ee39ed53d6684ab4ae17e789fd5f48dc2733cb0aa01c32aa9834fb92266dd93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a76d81f9137832c8e823714733ce1cbb

SHA1
dca9785eda0d4a4eb1fadf62f16e27d14a53e693

SHA256
dd3a01fc7873d58b8cba8d52ac6beb0706694f6f02ce9757289ec1e23fbd3713

SHA512
bbb61036fb046e26746e0b2e90ccb3d695176d80e67ce991edb7271b91e0ee6b14d80274a00508d35de388591b22f86bada3a8471a09fb25b5fc6fb2697c1484

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
252d3bd3375dff15e76ee7e8a2f9962d

SHA1
4e70b19cd91c390596866584850c28f2962a6845

SHA256
2401f6501de2ffab80578c8e51671ebaddd3133879dc9c28943a6eb96498f137

SHA512
f63d063fad9c05d544c4f22c77cedcea925e18242636a45d605e9a765730e7e65bcfe6722ef85795d5b26e9ebf73c415193c9d9d67b002ff641328a644d663a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
329202d753325f2c713cdcd1d43b3afb

SHA1
2a76a94bce98598ebfaeebf818b061c739bc649e

SHA256
cee55ea62fa0254df82f156c7d85b2acbf519f1e994e0d54868e81e8c396fad7

SHA512
ff88065eb52f51b5ad9a4c84f036c8da441fd92c919f243fc713fa4c8a50ed57f619a09615f1fe79386003124d7e889bc24f056961eca17d99099a104a98903b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3512309688ca2bda714d3a982a391422

SHA1
ec4f368ad226391c72352f39d711fdb009430c86

SHA256
08655b28a6ba2f7d31641ec71967cf2dc4e01ce4b77f3402077b82a78f21646b

SHA512
5818834ea5962a5b73c69353608d940790d86bb4d80fc53578c8a539e271195add5e5d3247984417510cbd0a9338d988d04bbe409c7385e796e1754f7ced2c8c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80cfaacf82364158ef9d692c8e8a3f84

SHA1
5a3af993aa75790bf11f3f438e1286c1fe7e1fcf

SHA256
a0f85a55683617cc5087581ce264339755ebd3dd1bd4845b6254f363f569bbb7

SHA512
0c1e9d14fbe72e92f7b6f1f0dcdbb9fc62936f8871282882aeaadb2dcf12944c77cc60d9947f39bc818f161645b8f229305f2f91761670f00a1b9ab7d7e16c78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70b2d9f4f3d875c04b24450d8d9e1ed7

SHA1
57272785996d25208a23ce0e53008da7401167b4

SHA256
b43bb5ae1221908374263e16d5377e5e81c74de7f24ff45e929998ae4b8b49e7

SHA512
5b00698a92176146f00bfaad319040914e96c05be0c8029cfae58b750c5706aa5a67f5e7e0c8fbf065e010bf6302c418e949eb8cbacd4e4f23b3b256e5f12aa3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC3ED.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC43E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit