2ea285b9e7f88eb17f5994c2ea3ac7f709100f1e70562ee9c2ea4f44314662d3

Analysis

max time kernel
100s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 20:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

879b511fa001f86c6c15a8313a31853e_JaffaCakes118.html
Size

5KB
MD5

879b511fa001f86c6c15a8313a31853e
SHA1

368d68f6c1ee91e350309b0d8803b1fb558f23e6
SHA256

2ea285b9e7f88eb17f5994c2ea3ac7f709100f1e70562ee9c2ea4f44314662d3
SHA512

e0de5e8602015d1659a79972cb713d766d39bfb9c641cd1d8b54d1dd0691c06cca49c2c99996a6961231eb598c500f77f49893e3500d5c96e203550942ff3b38
SSDEEP

96:tQiKFQ4rpA7ALiQpYQF4C5hoW0zKK3uDA1:8QTALiQyQyGoW8KEuDA1

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000c124c670fe5faf6dff7ad7217998c26ed4699c376efd22ce61f39f9b375c5fca000000000e8000000002000020000000aabd85cd0b0b20fe43e42663fa5885f27cad8d9a2994f2c2c3634f56ec1c84f520000000aac2fa095adead493e6adb073dfc39fac2126044cfb660bdc8ddc142f20a959540000000f31ff723ab85f79b66b02a925b29a87b5488d4d31ddc5bc8e385f3a43672b9831939881e360c47c3f630c37f916c5ccbd5d56aeda0e1f7759f90699ca4818602	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000469c626df642fa7c58c8801a87357d96c632350cfd5073ce36c6aa506657dd61000000000e8000000002000020000000f636b8aa4de470a883b7a5bc82e59902e422fd8f6af1d8a72cdabeff05331364900000004fb414304a79118ab3ceec0794150d287d34f567fbbef2068a8b8f82f0c98d851ff92fb61e0e5f4c6f81b6a7ff1c3d0117d7ab4fa0e9d8d210ab5c29d88ef9b124b92697fc3c929314aa39f330c87b0e11ec8e9272ee1c3a80ba80881f101d695e62db05a260e00343e38ff0358f3d575cc67c706bc0276448bb7c29b39483c1d67e04ee167ed0b6e5fc4dde64d95b7f40000000039d8378db2f994c795092f96f8f6ea6844df506d58c79ba3769b4652b0a5f09eccad6a747100e5eaadbb4f7be979a6bda230c6aff8141dce33b731b32f51003	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429484532"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b09a0e1966ebda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{430537C1-5759-11EF-9143-7699BFC84B14} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2120	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2120	iexplore.exe
2120	iexplore.exe
2464	IEXPLORE.EXE
2464	IEXPLORE.EXE
2464	IEXPLORE.EXE
2464	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2464	2120	iexplore.exe	29
PID 2120 wrote to memory of 2464	2120	iexplore.exe	29
PID 2120 wrote to memory of 2464	2120	iexplore.exe	29
PID 2120 wrote to memory of 2464	2120	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\879b511fa001f86c6c15a8313a31853e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2120 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8dda850137815eba7dec2ff275f9b01d

SHA1
49355c02d4f39e7cfb314f95eefafcd320d68c5f

SHA256
909645fff5df7320ffb1b3781c09afe2a988290661a6fe5f1fa2e8094616cd93

SHA512
c65de975024c0ddded58b2396b5a9c825344abd0f8ea24290675b05516e2db0ab710978360dbbd9f94f7d09109b34c046000358d4d345a8f0895f949c1827afa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0db1610ef66e6ade2edd36901908d2df

SHA1
c2e4510850cdb19cf61f1d655b04e69b9d77c73b

SHA256
c86552b70701c0d953cdfcb96c092961d11807ae1bbf617606909dca68cafc57

SHA512
da774cd1bbf3475acc4735837a69c2ab4aa8e3aed31b66df5bc63b21995f5de36591543265730c60445df88d676db6f4c6c30ed3770a21461442e1bb4c03d86b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
36ae1cfae707cde07a4ba264cf935f50

SHA1
a11c553f67a409e96b029039d67071a640fa900a

SHA256
5f2d905e25136c4e859d312f124ecd4a0c0c1e6efef0a7848f651e5b7bd4b6dd

SHA512
3d5e81c0b75c774c23531811ac1b0cab73fc6e6ecefdc8424f93ba6b48d19467b5abacc57a2efeb896785fe838b44fd876c171bf4b3f863a9b5b1a7d5a52d781

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d2ebc6c2ab098db69a04b388745bea8

SHA1
133b47e204ae8bfe52bdb9e06b8350fabf94eea6

SHA256
0939d46ffa5977e41f7740c4a8a920c059c5a58af5f229f280282587669fdf18

SHA512
02d830ce2924c2bdc6ebb351aa7e8863a77c15be4d5900ebe082b8f58aa775b0f99c81cf6513523a55aea9898458dbb9baf69d0a215b6815586ec6f8fb36b9b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b16c4539a2a402622fccf609c9c26fab

SHA1
2229bcfc03beb37f4e7320b3efd911d9b700e111

SHA256
097bcda568deb92676984122c3e036dd2e16ac4340a107c5154efa04be43787f

SHA512
82cc32a171976a84dfe32d33b0e03b203c89e464f955d0a9ec49731d7dc7e610cf5bcfaa21da22ef0839003c6ebc6684be0234532706203a776ff8f331912a04

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ff876093a9693a79b13908b078ba5f8

SHA1
d1cfe79d799c49ab55e3530fe23ca8bcaa0b7e0d

SHA256
f194493e1313b6ad124039d5345a943202e3ac949bcd210d98f31ac5c46e3f15

SHA512
71529327848ea07e200c3fb01e991923a4b35b169a13bafb8b35ae71386e5304bda0b4589d4968e3047e181ab79f5b335b235709c0630dc7ec7cea7c05bd0c1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53cc54c584e3303f516f3bb8d232a877

SHA1
5f901e57d6a0ffb6fa81a8c7f353f79cf2baa50c

SHA256
82ab84948ca9013a6cacba5eb6dd43e4bbc129333aeffa7f7a08fa4504ddab95

SHA512
bf8871544383b6783a0a65532dbd2bd2cab1177e15bd59dd67ca88e0874ddeac15f7024c920b27e3b327c7d558ab2fe0775739fcf441e9a8cad475dd88c59a54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77e85cac7e2b2589ea8f9c656b2c957f

SHA1
3e2b2720e971669b674119a8586caa148c98903e

SHA256
7d23fc9efb8e1d2ede693de8bd956d83b182db148be22bd164259df0c3e3c8d0

SHA512
de4478a162258a901f4e8de0f2db4c42daeb93d7a702a779170b00c8196a4095c4f238807f9d7516275c2cb84b4a2413375e61c26099f38c5f6097d3306d0aab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ecc41dea3291b11f3898981d64bf1895

SHA1
b2fd460e4225dae97fc7e0925a7437911a2bb267

SHA256
6bc511b4e3722fe0c26875a3cf2da65faedc1bba479922694fbdcc7430d53fae

SHA512
376b9197aa7f3f621b36a7fd4c1c0a150d44cf574576cf822bb1bd79349bb64db045e9be79fbdd3383ab390e27418266a785d2864a83b40c132c9bc83e1523d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e79c705552d260ad52afab49db505761

SHA1
7b381d1f0193705dfd98661cf986b15808154c82

SHA256
755789b8805bf5e02e3ca5848837e0d08209bd202bcb55c96a5c209f6b1f7631

SHA512
026cd20dcbad33e464c45183e2a9986f02a1e62c44b92ba14fd78d933f89b4de89e835867d9b641ecfc6d292f09e8a6a05e9a6b3d76a4eee1433b96910b0487b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28dbe8033be9a3531e1b2d085202a891

SHA1
6f72553109dca7f4791d233d3b060cc056d4c1af

SHA256
1b6e3c2b97eb7975decd81e4496d8d4af4be9c5e518516e03d4a65d5e1076d5a

SHA512
f5b664e8aa747b35746ecc7a4000169cf504c54ce483266a7ac744ef11a88fa2987bc9a400e727e4f3cd7346a7a21b65b43c86fe92d86d03c6bf058fee7662f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa48208ba996ee7ef04db73a9037ddcd

SHA1
81fd5a5c800f445e972167ecb6462dbb59ca1b4f

SHA256
262a2f5542744ef6cfbce57a8b79b5506d429036ec387deff874c34001d5ec1e

SHA512
abc494743ac272f9ce3aaf897fe023baea8800d2cc15ee23b28ce63a18cbf8b253a3b8fcba45b455a63689f83fc98e62587bae1cc73e0d5aa6071d5547b03769

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79e443dbd8ebe4fc8486e4aad96ad713

SHA1
f1cc2bb17628ae5b1a7108d6bc2f1789eccbab1e

SHA256
fb80497d0db1dee969258318db5b591a2d44589d4bb5462a8391a60358e02fee

SHA512
954e09999fb287da702029eebd9ea212d697b441e417a7e2801f12bce63d49483d10e9def4a3fcf9a589e4cfa34e911a78debd459af7452a444a3fdd4e697f44

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDB07.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDBF4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit