795f02b1274b5d677d829492fe85daa718963838ce6acfb513e84011ba8fd9e7

Analysis

max time kernel
145s
max time network
145s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
09-08-2024 23:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

83f0d9437eb269b6917f7b74f906abaa_JaffaCakes118.html
Size

13KB
MD5

83f0d9437eb269b6917f7b74f906abaa
SHA1

2f5923a0dcd92965c33b3de4ee3f524554f71e20
SHA256

795f02b1274b5d677d829492fe85daa718963838ce6acfb513e84011ba8fd9e7
SHA512

c15938cbcc2e6b9075812eb6f8061097e2d542a711c41664881962e892d35592b1b3f56c5daf8ef285af5b032cbb8de30569efe1da12719ecb325f0d0033f912
SSDEEP

192:qD4Du4Fq45vE8Fe4ozKL1n2H2xmPZD0oXWqj2/hX439tqA:qkjjJFDLisXwqA

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{731FB891-56A5-11EF-AEC3-E6BB832D1259} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429407275"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c920000000002000000000010660000000100002000000095f5e54caf1a3b8d99fb6002507802c669b339e38a1073dce4c38d749bbb1186000000000e800000000200002000000019e8b4378227eaf37bc16b7c5d6facda34116fa25a41e22006188fcdeef4fb9a20000000f389680798c45e72079ddca69fc7276b9b63c9d858ade567856da987f32293e1400000007fca24131eb5abc659f317aba45d426f733073d869a1a1ca4978c6a5104bb504378f9ac5f4bf07adbd2f09175bc562112efeb309298526e4d6db07813e0d6f0c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 60d73163b2eada01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c92000000000200000000001066000000010000200000001387d4e400c52a73e69ff4ca96b5b26a29c1d4843ff641173681b6cab25044fc000000000e8000000002000020000000aa885baff85d583ad8ce8aeadc47ebd4ed6ad03e806e98a31e0c77dd1e41f69290000000e1dee64aed10e1775d6627afd47d2d0b30f4fa51344dd8d9f8bc0d87d324fa2ce5f094c41bb2886b3da57b45058bbfbd869aae130fa0477284d7180d9a0e191ec09f48dda9e0c5ede4ef0049d127d97a87dd668307dd49e06260850a39ae31b3399cfd22785ad0fddace189a96da71c1a2d90feb1b14506e353733a65eea6071464c739f8bbcf6316bf9b6edcb7f7ff24000000019d244a9358a591beccd0a4771f9c68df307ba99bb9d8733a6e74d34fecc93562d5de0982c7aeb11fc656510a0b0965f09339b16c46102ee815c3ac766006322	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2868	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2868	iexplore.exe
2868	iexplore.exe
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2832	2868	iexplore.exe	30
PID 2868 wrote to memory of 2832	2868	iexplore.exe	30
PID 2868 wrote to memory of 2832	2868	iexplore.exe	30
PID 2868 wrote to memory of 2832	2868	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\83f0d9437eb269b6917f7b74f906abaa_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2868 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4dd058e910b1aacfd156bc6b197ecd9e

SHA1
b90622e421c0e3f05d45bc9c9bf1eba9dd8d4e29

SHA256
6d927a329de8e71f2b5527ca7a179210baed3c0fd1516680c544d78a5d99364f

SHA512
bc6c412829cbc118578d2eeac939a9e6150ef005a6a8ca4fdaa89d9777dc12bc592d1bb41b9c7d673cdf2c9e78c4bc114d323362743cf515610a0b72acc11222

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
219e2b96c21de7e38bc3335ccee6d178

SHA1
66fccc61af06a4199a8b8ed833cca865935f553b

SHA256
54175903448c2223f46eb5777dcea70af9391ea5a6dd52a6bedea45c6f73b9a3

SHA512
35814430dff497972eca049f35c49cd2fd3fea4649e61dda5accbf8b549fc8d428ddd91dcf6a61c2d4a80d209c70cfce7c089f4f52548e75de88a5ffc2504bd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2b64b933f25729010ec7fde33ccc04d

SHA1
4a392504c23f184b1b29b9ebbbe156a12cae299e

SHA256
ec9fc7c34886d75da6f2a1270d90d23ad9655abecc1f0b0fdedf845e4e7c5364

SHA512
f0736078cd1c6ff1e3a28886c5491f556e696b5ff17d5f827f2ea3d302aeb42f1f76ecf87bf5b2e5bf2f15c2af6431965835ec5461933bf5af74f44561c0da0e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
846b99b93b52d92a2cea43ac5bd1e1a0

SHA1
61e1259c64fcbbcfd2513b2aca9b3c61a256e6d4

SHA256
8e2e0da46ae8b9334ac4773e2b0504090f8b1347ccade95a4f9bc1521c147354

SHA512
23b7245cbfbfaf61a10374e42d3a55809c1d82643256bf3ca8bda327293b90242c398195191aa51c5ba083da1ad5df959cd080b974f322d37a0d59e84b25ae91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b8dbdae67ddb60da09d7bdf62b6156be

SHA1
b544030c74913817d76d38b3e1bb59d977d0e29c

SHA256
6b65929fb4d11721ea16aab41789de89fc096097c3e15f752f42aa32b3b53c5b

SHA512
2e074c13eaa341185e98aaf2988b0e9331c6aeba60564a88f8a0a0a07b3d8cb6d7866efa664b383543c2cd31f15d0dee749711c4db24fc9b1aa9299a0214d01f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
990d6fec9e6140ae32ecb9a3a993b6bc

SHA1
d5dcca2b3b52cdc87137e355e228976dc549fe17

SHA256
c00ced8b3d6a5ba69bbe60d2ddff0fb38822ac2ef3962dfad3857632cb0b5a5c

SHA512
d8d26134ceb67c486160f68b3bec8c05eec065adf2892dd589c662a3ef529b093b3954938e14b10b5f26f1e1206476741eec2a9dd38c76dbcc86f45841ed87a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3fe28855be07da617307fd84567eff6

SHA1
511f73eb2c5c546eb85357cd454f3168aca3e840

SHA256
99a4cdefc783ddf46b59f40712fb49fbb1c262f605ce56a6e6d5befd7f2c2e10

SHA512
27209599d107c6eeeb4a7dd759e4723b9f75e0085dae62721956e78fe4360de62d126598b26edd1c8c47cccac6d9060b305095066288bb7518138449974751af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a89a0642865b77e999ae6183e94962d

SHA1
ea82f71555a1d78945cf44c4e6e6c33c2548943f

SHA256
b366c3746b2810589a086ef0031dcb5871e1ece8308cd03c8c00491591ba4c64

SHA512
7b3412b94ce8b3c01095773ab6d6a27496abc6bb5dba88152e8aaf933483e36673577ed67854a04b9a4622507c51b4669d85775488c0a20075c0105ff53a7a5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
560e9c87e0fd21d34f5d607d19ecd364

SHA1
386e1947cf1f751e73481df44d24606d1b16c7c2

SHA256
bae3546791a2cdffbf57a93ce36487fb0908e492af2ec8a50f5b2c5e38fd341d

SHA512
871c214a63baa772fe2760c349be84198d1b9d459d5f831aa710681f5ab74a9fde19d76a878f8be26ad461ee22643b9ae1567d31a8d81e438441f4c291b96db4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3FA.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar592.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit