ae7fb27b8571e51fe627d6570febb0b6a0d4a750d9a169e075131680a5e1b933

Analysis

max time kernel
145s
max time network
146s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 21:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87c8ce69e0fcb3d206e9ebee2b300550_JaffaCakes118.html
Size

89KB
MD5

87c8ce69e0fcb3d206e9ebee2b300550
SHA1

0898cae2137b149466205fe3342a7d710e8491af
SHA256

ae7fb27b8571e51fe627d6570febb0b6a0d4a750d9a169e075131680a5e1b933
SHA512

d05e9c9831ca134c51417d686dc3d9239fc64716b9da6004901e129c5cffe703b491803a52a6ab5c35e169032cf9eb5d2679e4a900bb0a3fbbe305b99e35f80d
SSDEEP

1536:pbMjw2fMk1D3O9Pj2fce6kHAPEVL4gu8cZjqqoWp:sNWkLx+

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c92000000000200000000001066000000010000200000007eee031d229a3fe7dfff58decec16714b8d1bd15ae67b7d408ceea6d7f29e98e000000000e8000000002000020000000ad57d7cd74e4b9c304167ee6d343e6c3abe03989c8e7833afb2a73df7e36393c20000000ca59d68ddde4202d4b302459a7d3befdce7673746ffe573b7450a73152430ab840000000821e1ae1a30466501328f6030032142d5fee4f52900f0107d2f025849a9a07bbfee737f066805aa7494433f41077398f5f1b853cee4b9eed77cd925da7735873	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c9200000000020000000000106600000001000020000000c625a5e9b48d1b972622e3028910ba0ae52d1d7ea2b5430bc182cd09282a31c0000000000e80000000020000200000004851e670567e0e46689a89f093f18fecb45784acd679ce57f6ff34f329210bd4900000006427471af63f42f40260eb0af5cb088f7249e5111fdb0aa1307c0759e37095af50045ebbf6a31527dca7c16f8d9b60f288883c78663a028877fef77e07e5693123a5f740d132faf1c15605a1dd7153788749d79dc2837b99abd8438a191a796355ae3b319c839c493454602c0ada273cdf3437ae49b925624c010a716aae3b866ad5f471a11f579572a081319c29a81940000000d7faa62e552918d1a5882e6d2fe5a90bdbcd0b42fc11e8de9cce8da105450a9ee3c84cea1d4d647902701700b8d41e5bcb6b9587f590c8761069028a3ac1c73a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90e8f4656eebda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{784615F1-5761-11EF-AC6A-FE7389BE724D} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429488029"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2248	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2248	iexplore.exe
2248	iexplore.exe
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE
2240	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2240	2248	iexplore.exe	30
PID 2248 wrote to memory of 2240	2248	iexplore.exe	30
PID 2248 wrote to memory of 2240	2248	iexplore.exe	30
PID 2248 wrote to memory of 2240	2248	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\87c8ce69e0fcb3d206e9ebee2b300550_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2248 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c1d756a7fe3c052be3f0113257b8adc

SHA1
4180e5a18b90e17ff13dc24bcde7d6839454c3e5

SHA256
b82c4c5827a4d3dfb21d77c63420985bcb293ebae09bd6ea9c085cf1d9806e67

SHA512
79711cc3e2a0582ff6a06abe4a2d9b3a12dbdc198ae436a7d292bb46e4453bcf22d4b695a77c78ca13077891def64634f32efb02f2fca0c6f5bcba962ef1de1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bcf34578118e9ec387b70d8cc5ef21ce

SHA1
93d333a332700746589b7baab92d30226e7193a5

SHA256
b4f77d9e276df7eaed1a7aee3da908e2c05e64e5c274b0baba1f72943f1ea69c

SHA512
711329ed90cb29a32531e31ecf43b15723a0ac3831d1f53ff25ab2d2d077009df72861a951aedf76df105fc7221fbc98b8c1687f7a433519b2cfe29a0c4d1f51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f8fd81bc352487d1ea3af1a3ca24d90

SHA1
a725c1997869231d791874b3f1de086b31b8e477

SHA256
ace72bf921bf3cc77be7d017dee9c77e406ef26f15f15d3941b4eb5f02451072

SHA512
e99841afd0a13c59839d3cb1d22fb76ef2d92988d5b0ffeebb8b767a3783298e82b8ef5dacbda6a8dd52be27241ec1267610b33c82722c89784d962dc42410e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6141f00be9e5d3ab00a9695ffb9a2c4

SHA1
ce06e4ae65e0fc7f299ead34d998c7c3ef037740

SHA256
95248c73e25d4f4f5da308254fc40bdc484da83847740f38fb8c3faaea0f80c0

SHA512
5745a77121b2d2f4cd2ad7c49ff208f36532c8c7014f9b1994768bc070ba6e9879ac0b9651f59d7cafdd9a36439e149d4d7c8c6b6d48125790d4df52e760c9b6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7cd87664b218710add6e4232db2a00a3

SHA1
f2046822322e0292bfe54794b2e51737e8f319f9

SHA256
7af8137212d6c643927dcc6824a5ecbd5b686f9e68bd1d74f1bcd0ffa9ba3286

SHA512
9adc52626f7e8d068410267d332f9d056567d7fe433d1f1eb97e3ba1f116844e1b9f6cc872019fca61664b2d91c9c61e6781ed9fab60a0ac20d632e1cb97516f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21f57e3ee27bbf7b4ef5f7a4dc5d5955

SHA1
fd816d34cc58114cdf77f14116262152ab65b7cd

SHA256
5dbca0bf40d356d94048e09b15c96e37bfaf58cd4db9573c61a44258ee60dc43

SHA512
35514deefd69c73d7d3a598f77eb3898b147eab57712cd317d7c1f65680ba6c66ff4e2bf933d4ce456005abace8b616cdb52e94f486be8d4c4a43a6e2b1c70f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
46d009e9ea2f887d287d8b5181143a27

SHA1
e6604a4507ed8f9480f448135ebf45e6655b9bfc

SHA256
6875a8a8604aa4f47526f696664483848f7707b419c701d27a1688b4b79bac2d

SHA512
a927dc5a5cbd33c157ffa4ca5eecff1ed6f78fbdb7855876815fecd7c2e0c6d3624e912d07b8efff1ce138a222e093b7a45aceb43f073c7261d8ffb01b408d77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9735db834a8fcea7070d8fe4734909e1

SHA1
ca59b804040d6c47b4e6083cab983f48eeb31ac8

SHA256
92d2704ab4f79d375a2dba95947f1d6f91dfcd1deb39a3433656bf70e2c67e5a

SHA512
667cbcb1ce6dbfbc8ff2983f940ff04984d554011ac2507be6ef4ea061e92332a1e1c44c66042e67ba85281cc65876700963370e24856595b682ef021f6ae03a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aefa44945d8c46baaa37e7ddabc94f8e

SHA1
756a35e7c84edc47a7ef99f0e0ab67a72cfeeada

SHA256
fcc68feb18fe508e0906f796cf450e1a6c9a04582b9be61eee8bd36d055c4d67

SHA512
ecaee8990b5ba48a51b0e71029d6b43fc99b1cf72b7cb4c94913b6659bf19cb683cab880c185d1dd66819a2abad4e8532d8861370d20ae45effb652c0b6b0ce6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ea07774a7dcf8281919b34f4d87c65a

SHA1
cf042ede9655471c8e7cc5d0acdeb4ec82faf1dd

SHA256
3d0b3bc32a93aa7b6bb8f269ff47837742da1fc42770e7a432db54fb1458b529

SHA512
d29097876e5ca4ad75d5ec9436d1d12fbb48f3e34904285d3ea570f9b68ee635a529c77cfe3a815b032a65e6e97f62b198988d18aae8350c4947009241963ad5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
616cb4a1f866a9d612e75ac87e5d79da

SHA1
74e9094c25b25c7c747d371876334f0e43302529

SHA256
0b866035793109981b9f345ae800cc6821f2eec9911d848fce2b1127049f65fa

SHA512
3cae47025bbc4eed92cd9c6730931d63dd365af353d6cddbb86e64d0978c3c52f99563867d8014bc0a89e125ff121df8f396ce44c12e4ab85bfad66aee6589da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ddfd83c8a57b1d1ad89e00de332ec370

SHA1
c3e943421fa5363fe4d5263c4b7dd044f7bcfc2b

SHA256
2e4cf7a5203b31771c0333401f9b6ac4d859e38d604303c1b9deb288ec344dce

SHA512
6a31c25d6a9027195f72887c6bef359d997106e1125e755ca533d7d33e5b7ebfbdedf621bae0bc28f6b6789a4a5c0ded5c81cfa991270e425da7601e86faa31c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabA9E8.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAA58.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit