2d897c2a560655e31ea77ab0349edf9dbb3f07179e9b28a1df4611fc33bf416e

Analysis

max time kernel
118s
max time network
139s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 06:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8944081d151e0f22fc84132bf00e73be_JaffaCakes118.html
Size

20KB
MD5

8944081d151e0f22fc84132bf00e73be
SHA1

35077665fedfa2836dd13223a758659f0aae9a98
SHA256

2d897c2a560655e31ea77ab0349edf9dbb3f07179e9b28a1df4611fc33bf416e
SHA512

25bbf3fad7408e15789e29fd553fa3927084739f3f3d571865437f2fc40aebcaa7057c157c2e49d32579c3889e13ab8cebb20c5887a34846405d9b672609e884
SSDEEP

384:4+QfPFd9QZBC7mOdM4auKfpC5IgSnbmFe7Acw16jYHMPd:Zcd9QZBC7mOdM4wpC5I9nC4cMPd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{14DFA9E1-57A7-11EF-AB78-F235D470040A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0df5befb3ebda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429517927"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f0000000002000000000010660000000100002000000033f95500f439a4e04565efbf14ac9a41c61327e8e48388ced5236452853d10ab000000000e80000000020000200000007caed6228c0f4d3dc33be330a990e3636ae8db3b12b81bec1486a26c0cfd65c82000000039203162f1070ca398c0b80756929f3915983d7d0f11c1a07a2a14b3204703dd40000000074d5109afbcafd7499823aecad0d651f4d7ba13d15c87ea1b17543745fb01e38fd3c3e9259cd57e5a22fcec0d893895045aabc93605656e23900ad5d60ad23a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000fb63570bcc924b941e7007afe93e0bdb9657016610ba315ab0d44b47757056b8000000000e80000000020000200000004158a3b3cda3e1be58813d34b5572d7790696a2c04b036c2e9ab5d7328a67fb890000000adb8b6a5e74dab74b8314031f8dabdb8badf7409c2d7a468bd1d65506f849ca36f8fae46b81a31376ce66290fb0921a9ba4ca38c797dd90d9266c9bf13fdf78b4eca5a2e3771884ed9c16ac09f2bd76f0fa5ba3ad6147a8075ff41dea17951cbd37b88feab8f7e43b0a5a02858bcb5e7f517a3063b5735662a70cd9cb9a88ed5315c8b103164ea13f7ee563a7f5229444000000008afd8ad9babb27c24b6345824eeb731ddfa0bdcc74365c80240d6843b2dda99bfe527bfd1c4e9d4fe10663958c8266e4c0f82931cc7c26e675ea68d4833ef5e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2088	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2088	iexplore.exe
2088	iexplore.exe
1260	IEXPLORE.EXE
1260	IEXPLORE.EXE
1260	IEXPLORE.EXE
1260	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 1260	2088	iexplore.exe	30
PID 2088 wrote to memory of 1260	2088	iexplore.exe	30
PID 2088 wrote to memory of 1260	2088	iexplore.exe	30
PID 2088 wrote to memory of 1260	2088	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8944081d151e0f22fc84132bf00e73be_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2088 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39f4617e5c97f3428cbf2d2693143eeb

SHA1
5fbae868dd4f34d2a0e73d78ad9b1ab56ca9734b

SHA256
0a5938a1f72006c776824d16ad82408b873ccb8e7e4fef742e8dc69cd70562d4

SHA512
120628d3e2b036d5d78d18353abc4b83e016a9f314a58c55394ab4a107bd0ea80ad28aa3105323fbbe50c4f44b3869607c30d5f21112972635fe1e6f9a2414be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
153e6580901bceb714a5040c26b1e960

SHA1
95c0dcb1a9b699e5b46f940777b64183ac5c6309

SHA256
7a0a72492367098e24c61e79619baddc7cbda762e16489c32e60c7936e1451aa

SHA512
20c2cc0ae55483cb287466602c9196e4207ad932c07d9b2651c5ded5391dc6ad5e852734eb8e7a4a7c408d7f29911e553b2de92a48470f190004a64083021b23

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4062fb39fd8eda79754c9c096b2c283c

SHA1
330acfaddd36a17ab91966e831ffb00b132d8666

SHA256
e4672c798e704f35f35dbad5453e40882ddab5e4c3bd99e02c15c8642e8cd5b2

SHA512
a5aac1ade5f4d800e50b3f52b4af85b65ce235c008abcb7836a7aeb42ae4672d97a2963de47ae58860946793601770f78a2039bfbbf7ef81183430022c025c2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b53d545981756fe5816001dc64fa55e2

SHA1
b855dcab45101566a7dac8b680864e628c781c45

SHA256
fb6d0e5614f1404a8af9281a2e30b2fa2fbc29f30677f6c2a5866a3af9a19c2b

SHA512
9e0dbf66d3674190f3e0552f0e45ce741f8b10f6ee239a0a33ac236ae340d7b11a5955cf022f43bb0cb4dbd92e16aa8c914fc4824c2ad505cf9953c3160260af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49ba4cf55c09ac04bd6ad2a01bd19b89

SHA1
b7137aa13b823efaa92d7c60f2fa8a1501b0bf2f

SHA256
b896741d218030ae82c34addbc572d073b94b8c4e89b9dc79578b0d01bb305e4

SHA512
56e2cbe2b286eb10bf8037acd3adb6b1381f3c78341682f6f88b38a87c2c139ee87b3fe52b1de110e61227051acd5c332d88c8cd42911a0a865088342db3b00b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1fd559b01de265d00c0ce119f8e92ba2

SHA1
f019c276eb31818a912028dfb76eb8ca41da5e37

SHA256
14ef58ff75fb9157200e729869d81264b589ee3fe21bffdabd9b6bc6ec464a21

SHA512
50d2992e5dda205499339ef471d78d1214ab492188e4c39e16b7025e2e300d7fc35c0a6ac4b3a4201865769caa3311bf637a6f98c47e95a4e2db63ea837d5879

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c080345175a557d5ab27bbffccb1b6b4

SHA1
773a4c30bb125560231955381cd526635d704dbc

SHA256
e8839186021e5bc76d81cb5321ce2df3bac98832434ff0ab758327332a56f0be

SHA512
757e5675cfe6843be0f2955f57413fb2503aaa7f0db36b0b842530b467623a95cde09c5fdde63b0af51566b55461893c4cd46908f5ed22867682c794d08cb64e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25e2281486c009dd8569094316fcb8a6

SHA1
9583a9063dcc1c1dc2e50d6f1194fe6a6a720bd2

SHA256
f5ffe7976f6f077501afbbe73d7935169066a2420c4e7d757ff22487f91acfb8

SHA512
07449a40eb2832613b5bbd85c4641b89e8ab2a987b4dded2d526389528d8612968ea1b1e87f2edd661a937497925dcc013fbf59fb7ada50ec06d12d963aca025

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0a4d740f429f94ce2e64a7054819c0c0

SHA1
15630c814626794918ca89e71d4f54ade122841d

SHA256
f8ab9384143a9cff489b610bcb280485355c77a7eec73615d1728c71268a3695

SHA512
5dc2e5cb687e636794329f7856daf415ea62d2810bed8435b2f531827c18e415c804e6738d642e9810a9ef113d36c85f4e839b74f5c31965ce96224488ab6b1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eab4849adeb828abd948693257879d0d

SHA1
31e30099382738f879753ac780ce7ed58b38ce66

SHA256
eb628207b985d5236057942b7c0bfcb543b1f7894b9accaa69c6e988d150ebbf

SHA512
540934fa747fd46b1ff57fda95c902d9751c0c815d070b4bdfc3b7656b21cf7e0fa0f6b1e6c9894caccd1fe31e58ee8971aae703a5fcae575dda6c1f7f6b70b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd6b5f512a18f6d25540e8636914fcf4

SHA1
db406614e24944cfbad3295ee8ca5f7336251edc

SHA256
fc0c405c4195a0dae45b9b66c1010ec905e02fb6bbfc598c450549c4a9e83c03

SHA512
211b55179b8bd1a91b07fd79a0ecbd255e21152a586c8e40036ddd7dfe338c350f43290aaae0dccdb974598e8cd41dc908680fbef9e3714a74216f09512afc45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba8cfccaa2a9aca95d860d3d30a9e5c1

SHA1
e073e53d332ad10cb48f1f635909eb53d7d79b40

SHA256
e122ce37d7e769757eb7667b279abc6fcbeac8baeeabab8c99fe8c92803aa3e4

SHA512
91c9e6a906754fdb81235a51bd839a4b35862a6202b3b1b26c956a0fa0e7dbb3728e40a462bc82472936150c03b3080bbc0a5b2f1804f5f7c77710dcc0adde60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80670a2e617b1d342d7ba6f9e3a9b284

SHA1
06860f51c7c1f761d5afae5ec4dba33ce1f2d6b0

SHA256
0d833c294f40f5662ae6e273f0e2622ad80637e3acb93fbd4606a312eb97e0db

SHA512
1406afa6457e3259614065d60e029a99f923eb1220853124ea0b53befd2b9c66314a7ae635628a3948978452565cf0b23a7dacd97a8290e1c8a95fdf8f798301

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fbef64c1da009bc493ec2b07b4ef842d

SHA1
e9faf182aefff9e4b15c8e74a89839d7b0164c55

SHA256
1b99483455a4763945aa8f7be5319552b6c8cf10f91f78daad33864e66b4dfc5

SHA512
37a720179f56e847f2d9885b23e6161f76c1f93b628fc6402b8427279146268277d25763c2ddaef342475148a5512bea759a46db8f9a64dca6a951bfb4f6b5b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEAEE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEBAC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit