311bd126d93ca86ab8635cd4ea475de55d84e9d24d43011263741c9ed1ee23e3

Analysis

max time kernel
117s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 23:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c5880b81d01c552943fd3e844264a35_JaffaCakes118.html
Size

3KB
MD5

8c5880b81d01c552943fd3e844264a35
SHA1

ba81ccbfb70da3afd2a0593fd38833fef6981141
SHA256

311bd126d93ca86ab8635cd4ea475de55d84e9d24d43011263741c9ed1ee23e3
SHA512

c8eb7e9dc2db65f82de468c51a97aba106b62eb93c514124a2cd95fbb64f05c67d9228c5856d15d10d91b34e5593d52e89776e77712ab04db689fd0b7e61012d

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000b9618b5a75f82e79c5accce973077ea474b46fd9f31a0c2c93892498e6e51cd0000000000e8000000002000020000000cb71493e25c2f8019cc7b88bf58d11351e0062d3814dea09d908f5aa9a02686590000000e1c27b82f64bdb8e01ad831483d18a0a75194f2f5ded64fe1b26e25d3b40fca0f729c4c34cbe4d2179022e919f7a696d8f0a20b2500cd1eb013937e771d229f0f5bc04dcf811bbc5c65b21dd089f1a4bbfa1585d20a5df3e8fa1b48f579478f7be97c3d6475918fb4a8c9cc092b676e1cdfcb13faedd4336590b2812b59b2f6b2e53a2d9a31ce785e4646db3d53bb861400000005bafb541fc12f2502ea4b955d7438c420ac8d1e6c89aebc52a61562850dc93e051de00c06ee336e171dbe87b7c036d27d9ef4afa8e79a0ba0b9fc72bf01ed2cb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429579515"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7AC45C31-5836-11EF-B9AB-7EBFE1D0DDB4} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90f53c4f43ecda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb780000000002000000000010660000000100002000000006df4f2ee063887ce4aa3c7b116eb89533baf848db6a91fba9202e8bc96ec76a000000000e8000000002000020000000848cd7bf49ab88796ce9df23983c1ef3f583e3c373bad6c335bb4ae66599538d20000000bec7fa3e1f4f7e86846f55e27e27c92d963c9c67c05d2280d7b9a48f687d8a6440000000d339bb20298b0205f7f5eb80dc06d00dba1dbf7f1f99b73a81049324d88dc97f7f24f8285459136a8e37f66e3b28ee182300bb66e591c18765d5a4c73471a812	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1908	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1908	iexplore.exe
1908	iexplore.exe
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE
2412	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2412	1908	iexplore.exe	30
PID 1908 wrote to memory of 2412	1908	iexplore.exe	30
PID 1908 wrote to memory of 2412	1908	iexplore.exe	30
PID 1908 wrote to memory of 2412	1908	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8c5880b81d01c552943fd3e844264a35_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1908 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1383c6fdcdfa6e243fc8b83a0876279

SHA1
8fa80f7decb943b27b0ef496b1ed6766fa12c60a

SHA256
d73b212008d40fcffa6a7f5f0e40cd36d6cac869fcfbbb534246bd30ccd9d8d3

SHA512
821bc4fa934d8ca33e2b0a0ba40d886870f93412cfd0d1449e409a1c248fbd688b58e5c4668b5cd5470070fd3e15c6fc47fafe2ba492817a466014ef66caa962

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1e472c3694166073e08e6f1307c7eb9

SHA1
5c3cabf889600346b3fd3246db21511a67b3d37a

SHA256
974eb9935ee7a6eeb062f86310b2494ffe43407ec7ee1203a468619fc501d800

SHA512
98dc381c8f2b71923147f5ec99a5ece524c849fad8b1e7e667d91df8d1d57a8ea34cdf4924ff309d8e45a19512937718135894500e724c0dde0cfeb852888dcb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ffb32246963b280a7a60be83fce63ac

SHA1
7c84e8972e4aadeeb46e2fb71640988001ad0bad

SHA256
870bfac0a9ecb2b3bd50a49d0d34213a3ed05f48f2918378b1608082b30b5dbb

SHA512
96bf33f785c4579903cb128f5d5f53a81e3a41817decf870ba11c9be036e446debe3fe76374c2112ee8c320062a8509096aa0edc0d83d255c77bf58fcd8450ef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6befb8b9cf7d8ab7df5254b558e03f9a

SHA1
7095fa03f651226f155f01f2456f713df91c6a45

SHA256
0affabccc3e0b876c8e964c5cb2e95e48acc6a31240e12560ced9b4e44a7ad7f

SHA512
594de61135f98e07341052e722dd2d38340f3ae1274a00062df13c1de105b612b8414afa92e78eea99ba2952b249b2624aeb4afd1b688ea1ff73ff036866d4e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
501d54b8fff0012b9759d2ec6fcfac1f

SHA1
9a70743e2c425499da83a561b28030a15d5622e1

SHA256
0a452d390ba8d143ef2145f2079163a746c91949a596ddae020e15fb09ae8f04

SHA512
9ed6322bfd81a164bc864f67ce3383309fdd9940dc645e66f1ac0c6422be09581d881ebf5f12b777f64cedcc21b0805c5f729cdd3c646a1124a99f2208594550

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f17808877173e43570217ad1238f2c28

SHA1
325b7dd736a1a0b8078ff139296e5e9030e126b5

SHA256
2991ee3bb9818e2fe946b6d0b6c381b35baf5d5a7609ba57f718da9bdc1c9319

SHA512
d9bc5efc4df5a9332bfdf0a8e7f1887c84d5f783ace524af765998d706f68c03ea9dcf382c155be1409f25840b31858b317308d836f06bb84473f5ab0e0ae8a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8f4f3baa62d2256322356d32c1b940b

SHA1
fd7e9e017fd1f293d0c88135b0054a2ca0d836f5

SHA256
faeede7db334bb44023c0b05e8cef72550e2a115ae98936388a19d60a4909db8

SHA512
3a87cc9ffb574530cb22f6d9c075883d8da34f9d8f5bdc9a3e3a4fdc16b4dbc81795fb5b35002c7989b013a920071e540f610f1b2c2955a6d48a4ce4e1b010ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d995995e66ae60d2fa55cf2e0b294f8f

SHA1
3be469f3b10f8408b739aeff32cfcade3e70f97c

SHA256
756d0f957ff04a62880643b20b83a856f002b43ec77ee87b4eb2bcb873c1950d

SHA512
6904e69b95e781e29c468ad995a34fc6affc38495885df2d330e0d1c8e9d991c18f4896034b77ca58799ed166b8528362d29e61a6c1382fb82c52ed4eac3b70a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea8a69a3d1e9e7948043a98499730554

SHA1
e53b44ca67d4b877c7e76e709c0a3db693f0b358

SHA256
3734681051ff08c2688006d7101bf27fb5c8a8ccb4ae2ecee8a6ed51297838e4

SHA512
6a7c990b65ebc5c7388e5e75ffb95d5edfed56c2c571bf4a5de43a90e1646f2cb5ff30bf78dc9c18ff1e750e2b5f9ce3980654823240d01e3b578124b52e55de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b750365c64c2fdc301221c1e39069125

SHA1
e52972daefbff912ed64ace7a95099c4a67424e6

SHA256
4cc133884c66dd5e29f0e81dc2a61b7feb839865623be451cda6202edc03a272

SHA512
d83279072e9c22aa0c6dd53eaf305ff4abf05f257bbfa08ddffb9d54cfc57625ebb3ce2be133a9f91b9a5a17662899b2a269787c79156065ab0d6f6f957ed5d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
28816981580b49db681dd4af2813e54f

SHA1
4088cc505a02b0dc2b31e4f5c8593896dfea5291

SHA256
50aed5fba6e2e612b3cbebcb6572e7847ed51ba68a137376e764f0993350956d

SHA512
0657bcd16950f9b2f7a75fa409076722616c4b5b22eeab9e3a10808a99d4ed7ee4a38a80f47a0db227a2cced34c0e6a2f35006d410332dc8a94c7a7c03c072c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05c0441cdb845369004bd663e3092e19

SHA1
002d0eb46443b89e0f040b1577d8eeb5d442cd18

SHA256
43d330cbd83d6bcc6861049860a351cfa67584fd44506a97e3e7cf2c5f71b33a

SHA512
5484125e705c3a9b5650cd90d924669c9566cdcf6cc31d5f057096f04254ecc4cca30d5088659ddfef4392a2ce6151987345780ef6d99e25ae96bd0ec3573de3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e81cee7ab6d98e10ea05ffae9bc39008

SHA1
b4a2ebefe98bce338da21d847a566368d0aa447b

SHA256
7902ff02d313986835374a3cd44736f85b172765c59a870e58f92e96713e7cfb

SHA512
47418bec3239baa943ede6d969c190cab573d3a586192de0a3bf5fd1e85be5a96d9e21374dc0c7b3d6fded250416da671a0c9bbc910f6496aa4fac0a8cb8ddc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDA4B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDABB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit