2286f199f7913293ba58d9a0271329a5394a3b7c1ea4f0bf6b9e3c3b1bfb8391

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11-08-2024 22:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c4f50c04a2581e2490d8d7378deb9e2_JaffaCakes118.html
Size

8KB
MD5

8c4f50c04a2581e2490d8d7378deb9e2
SHA1

73eacfa85bd95f1b3d89a28aa020776d30067f60
SHA256

2286f199f7913293ba58d9a0271329a5394a3b7c1ea4f0bf6b9e3c3b1bfb8391
SHA512

4f3feeb6e06fe8e9fa3099f1d158e7a22a332aa2463c85b8dcb8f98bced2b327106e6ade463a7e28211ee9ddc7d94e45b3369e2783540f100f2ea2652dbe2286
SSDEEP

192:LRaV+K5lJqpq/UNlHzyE/GR49G2KBj0FL+2mqIg2QI:LR4VkE/UNlTxuKyBj0FpiQI

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AD6CB8F1-5834-11EF-A669-4E18907FF899} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000cc9d3b8f685a67c36ad0d8ac75a8f079a4a707b09b53d1bd2fed7667c4e11256000000000e80000000020000200000007ae41e658691cf2b5277e4a86c744c056958ea95b0983f288fd24d9c8b3876e820000000c88515e6c132f6cbbb2dce1ae70cb4b76a827092a5c8c272c2a3cd5a1d8c4e68400000000c6e86ec5ce1c60ea35e1fc0f5a843e9ca11038d3a98cb11004db1095a3b8ac2de0d3b7bfb21a59c67f17a00929d2f542a93bb6f890197569b18a8fdb4ed7b00	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b02e128241ecda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429578744"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000fed0fb61ed281c56db6ab69de50edf1687021e47791beccc0d85dd198311f6f7000000000e80000000020000200000001545c5bf7efc0860e18763e9701f00cda9c1e4664857ed18e7ac9558368196e1900000008f3b6e75b3fde8307404bfa2cf9647944eff55442499ad1b33c8b138be4988e80fe90881316a2be461b4793df39b17807abd7c1c76b756df7ca60813f1828d24a5a37b19255bde039b2229af4aa0d9be4a8300b1ce72223555f567d296ce585968f8302062728ece7b624c5424c56538712a728a1d63795d025875ebd867228ac56a73ea94a166d58947f22fe630da774000000029e7468d8943cbcfb107f7c5df8b13d6eea4933442b5f0ed046ab26cdd2f6dfa730b9be1ff52c486e3948d7e07e1c1de73da363156761b810e4a7b401886971b	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2840	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2840	iexplore.exe
2840	iexplore.exe
2728	IEXPLORE.EXE
2728	IEXPLORE.EXE
2728	IEXPLORE.EXE
2728	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 2728	2840	iexplore.exe	30
PID 2840 wrote to memory of 2728	2840	iexplore.exe	30
PID 2840 wrote to memory of 2728	2840	iexplore.exe	30
PID 2840 wrote to memory of 2728	2840	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8c4f50c04a2581e2490d8d7378deb9e2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2840 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81e4235f3a1b83a20303bac1fdb55f40

SHA1
cdd4df62788cfa584471e5de1ddb951a7a5648cf

SHA256
f143f60a940db1115c3140ed2644758828018e5586059c23e3e4d3bc1772187d

SHA512
af99b42c10c4b53c97e0799674e02cb65d063f71ffe7b7e101968cb498ab8b9c5a4264866584d85f3bc415be507ae830db8496118179bdb811e5a0299266f2ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0f7bcf9783356a54026993a93b86121a

SHA1
4c5df5f38d16d74df7614e111c632826a2adeeba

SHA256
a0fc6aa54b68d00a1a660b185dc592efae865388808920cb66b29e0c14116009

SHA512
9f7259b1f86d535643e2a72072196315734d0aa6802d65275f6640ada447e0c421b750c8ea2e56e9e1b0d7b159e2827fe4e7451fabbe43fa9cede7306accb6db

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
980aae005136341d4bef6c374c7fb254

SHA1
48920d2a5f83c39114c708439d66ecd6c1fb1ecb

SHA256
1226517a8ba9835498c483fe488282d223611243e91cdc62c618d8c20abb2a20

SHA512
210d5d575b2565f300c1056d1e0aaab252163dc42b44d531444a6a57ffe55e5bf63485a6669a197659e116928932c33035ae54ac2dee33ded1b0552313afe5c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b3eb8791779a35476bb7f729da04374

SHA1
a17da0b613759dfa6d13c62e8eb60160404ca616

SHA256
0781aef4978f9f8189fb9a7374e7821326985d737f088b87eb203f70424d1d08

SHA512
49ff41d00c2581f586cb605dcb01599faa93d3c69e7ede218a35670db872ed75656902868bbeaf7d4be9cc3f2023c1a6905f8e5eeffa42b2d50ca76ab37390ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
066db56980455b8c6d92a110e0d14d49

SHA1
c196acc4336cbbb1b6803b049dea1b313952937e

SHA256
9bff9709a67c704bfec8c789fd4a6ef7478e4e223ad14bb874a180348c88924b

SHA512
ac9beae3a770695f7402f993fe1ee93b83bdad8a5c6409723145b6edf2fca9c448384a6027930bb39031a18c013fd9807011661a1bb7a745f58569f881dd7024

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4126cf49ac0ddda771c050b5de8277b9

SHA1
423641d774d9acf36d5378fa7bfa108854b4a403

SHA256
4c7435f0dfc23534737e34e7aa1339b283c796185875b32368b9ef6a2b705089

SHA512
bb3dbe04f1c9841a843f20d829115381ea4231a1f70c207160bf9a87605bbf332bee8e327e3995d4a94624085f075b1ae67c365841569d200d02701859175366

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13253f063a3f6a981aa4c10df6b964dd

SHA1
382add9db67dfde57c3abd3e0299729c83f2c2f4

SHA256
b236108d14e5b96f3180c8da5c6f8b78f8f7c13ada57d72821bbff60aa4a8713

SHA512
b9e033392a05b75ce1f84ab7df02dd7cfc95eef65cc74b39b324463d09c4d2890f887d64bbb6e708a6915fe572dd47b0fdb7c60254d3db315fc991dd5b57af8e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a338237aea9b09b46eefc8e85977dcd

SHA1
2567e394e67a9f6427f48de335e41f8404597288

SHA256
939c8a746d7cfd3fdf092759c58ce9a17b6b9f70ecdef2629c39b8fec9111de5

SHA512
51683df305b756647d7cfabd45602d2eda7b7a4c34849d5c8c9a50fd00a89a6b9c46e4fc57e4f50b03d36a52073fac1114a62f83ad540ca7fa8042a1e2d97be2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fa938e3e24ca908f3d4e115aa75abe5c

SHA1
343681c17ba02b1311c6f9b5849d2d7afaac599e

SHA256
0dd7e018bf3ae6f147fdae59321870fee964cced4891051f587780a4d26758a3

SHA512
cbc49cab3c268c0ee84606630d9dcabd985c4a48a916deacc1efe7ddb2405aca5370624c88b5ed78dee7da4b78d7de2247159a2bfcbb64b0dbb93f47331a9981

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0812a105a3d9ded581a3fe23c25dcfa4

SHA1
b6525564bbe983320685d7b08cf0444d62caefa9

SHA256
df72bf9d9e66b7403041e6a9cb13ccdbf506b7d359588715162489c4ad9153cc

SHA512
55ad24472f4f0afdb931cab1b69fd866fd7954a799efe267b9fd1f0160c6bfc2fa8878d118251819279b39ef4601f79cbe5c1c4afbd3a3297d2585691dc47717

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba93f6cd4efbc60282e1171643846ccc

SHA1
b7128010485e951db5e9eeeb24a9f1ca6584cc53

SHA256
dc984ee436b9311b310f9dd88cecfd5a3bc5f2f11dde7c1e4792c044b7748c5c

SHA512
75ec7ad458a9fd98899d7e0b650101c4d540197bad43352d803b00ea93a2e85ec4a3ccfc7c143ea1b1876f5b4514de248b58ffb142879287f155d50f6a988bb6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bff2755d78c8e406cb4491bca1599f05

SHA1
b0cfe64eaf3a553682054282e81a70b4819ccf89

SHA256
79ad91eedb57b60e7344ca1fbbff29947177834c9227bb23bc301854f60aac8d

SHA512
68d1152e8602d5e5aafcc30ad67e7c4e7c3ff253d9009d70af3d1927c2795f43ffcd008d88eec7de591d6cac72e1de876d3cf8983b54d58df8f01b098e6621e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
290b117c61a222b62d64947e578a74a5

SHA1
5b3e135a417178c26240c32a1b98927ee6b5c1d6

SHA256
380e611c8431f00b921a649114a9675954c28b1589407a94ee072da5bcd4f31c

SHA512
0ed9741cf7afbb15c080a1d4a2c6bb7a373430316806ad5a1defd3b3085c9e54aa60737edd59c7a176a6f2aed365de8b869fb9f5bbeadb07f0034dff2074b594

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b1d7c16512880acf1b9a4388fb1c6c4

SHA1
cdf33e435de5a5f5ebb336cbb78d314caae9be95

SHA256
8e9b9993e87716eac190128bf33173216504eb73ba9b50677a648eefb01b0df2

SHA512
21ee7991491da5388f585622e9b2314e09bfde088c304fd6baa5c668aa869e58bc742b86d8784c3ca6463a7ca3f71e257a66300a89552fbea6bd87137123e0df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc56153eed2108b13424eb772d1a3ccd

SHA1
f7ea8e8f5ef60c000c103f43db5c4ea813548bd6

SHA256
9e8a116fd7a1e97c2da54294e17c5d58fa2634c736f253403345b4e49e99e778

SHA512
40e80c652c33b9cb68c8746635f716912c7423d88a98767feba4a3296ba13a1ea734006de35504adba9a48b8e4f42a7ffeac679f9fb735df673d7b0b8b81115a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22b58cc75f95e7c1dd3814d554f61b23

SHA1
eb8d9c2f4289eb05c9f4c451e7ae9224f28558fd

SHA256
8903f74fdea11c56d9579a733f586d1c963b2354fe6282ecff77eed6510bdbae

SHA512
62e07fd28d4c89e119f49deef23569c6b0893c3e042db3a04b7568adbbac80db093f59ef4e7b77467fdb5a58fc9c8362b0deaddddad036cf5ab9716b2c8611f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8163.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar81D3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit