d38be3b65eb6e65a80dea41da8e96b16737fd34c349d6a0e07d0572d20ace65e

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 16:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b2e825d8d5980c9971f1eb16d4bffcc_JaffaCakes118.html
Size

6KB
MD5

8b2e825d8d5980c9971f1eb16d4bffcc
SHA1

6a05e3b3992ddcb29a6b29b87ba0559b992111d2
SHA256

d38be3b65eb6e65a80dea41da8e96b16737fd34c349d6a0e07d0572d20ace65e
SHA512

c51d21d856fc17cd98243eb36a2a33ac405c0860ad642c09feb2c82797b58d3cae852fba9a1161fa58713f7eb7da82ab5504cad0eb99928de007e6192af02d0c
SSDEEP

96:uzVs+ux7vULLY1k9o84d12ef7CSTU1bx0X4wcEZ7ru7f:csz7vUAYS/Howb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000032ea866fd1a7a68269d9a6e74df602dfd878d09e02fb53c08e098cbf100fe0e000000000e8000000002000020000000a48a939fa1d65f40d3a884e9029465cb241ec596c5640fd5a27ee15dd9ab642c900000009e83a2ae6e8aee5d18bc0775178ffd0bb54898299def7d228c1a38fd1c16cd4615580f5460f0ff503cfb7e7c3f83c0bf5e783f6e3a34fb683ed4d99c4c9286f959643041f5ce3e2d41163af6fc75aeb01f89f277484398f1304211b5f6bd97945bd55f642639a5594eae2b933480a2ffb8ed343b19183651f214d76a528a032e2ae8a748e5f1a4f8726ddc78b516ee73400000008425374ceb951fc0f3a0db28866218a12e99df62eaadcc31d78ebb7fc56fe55648c4168790734615c34db8afbc8479afb91b93038dabc09df8c3d36670ddf249	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000005f69abbdcdc90d3640d1845d45e6d13b1e7162175e690b893921013ecec4c1b4000000000e8000000002000020000000a1fea2754c5e1d6447b7582ec10413085b2fde9bf8ecc0b6bc9a6e30f0930d51200000001bac01962ea770011f41d65ac16b3eaacb51fc69d587a370ad3f24b35aea303a400000003ef9a96095cedb76dbf514ffefe054c8fd4bfe1216644f1e81dbcdcf2d52c2796c646bff2606d95b50398411c0f993ad719b9255ef687f8bea24dcf42966be16	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{64998401-5802-11EF-9FF1-E28DDE128E91} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429557147"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10899b390fecda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1476	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1476	iexplore.exe
1476	iexplore.exe
1640	IEXPLORE.EXE
1640	IEXPLORE.EXE
1640	IEXPLORE.EXE
1640	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 1640	1476	iexplore.exe	30
PID 1476 wrote to memory of 1640	1476	iexplore.exe	30
PID 1476 wrote to memory of 1640	1476	iexplore.exe	30
PID 1476 wrote to memory of 1640	1476	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8b2e825d8d5980c9971f1eb16d4bffcc_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1476 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f7afa49e0494b6b8a2e262a036552fa

SHA1
e148dd29aade8f935868d0bae5a4729440c9085d

SHA256
0ddf2bb6b6686cbc22e694feef72feee4fa6d0734c12af4bf8c74bd947da61e8

SHA512
507c9db42995cf69765f5a7c014e1897358947ce292c828a17cbd84713b66c699e565a0875b37aa799d59d8b3162c703cc0feb897b5cc4881f5be4c125473fd9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae3ff4d49f1499ebc054cb9833b851e5

SHA1
f50a0a66c66e4e13cffdd86056e872d7815393b3

SHA256
624a16eff58ca27fd8852865035e828342df532776b8a1abbea6702976e0edb8

SHA512
5fa82d64d30ba1a7c8a1f5413e73888dc7ba0ef8b5a8fda6202ff7ba53b17618afb3b309025c2f5936a25993ded4217a512dded289a3d5a5ede5210a9f20d100

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13d0c86068d7ef7909162a86f5a2270c

SHA1
765595c348ccf97ab4efa5ea6249826126851bbe

SHA256
8fe0ae2289decbe32a12db611592997535aefb2a74205add904e56be33e99358

SHA512
8d84ab8412e2cabf706dfaa65e898b3add6bdb400a86ddf523476a2e57897b8d0c2e7c077d0ef06e98e2482722c5d6144d04e0d735184b020421dbd682cd27ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0aa43df6b1ba09f07588a9f97f682cf7

SHA1
af3e75a745f9cef0552da37b749d9416c5804bc1

SHA256
c8a8e57dd8b579386c4d9a9a7916ad6865bd686c6d74f74043e10891e4534c0b

SHA512
bc2f09bbab411ec4d69e3d7743a0a73f517df08f5f444007c5e37705851375183e442acc32f4a74ee1a2f5fb7461e3122c3ed3e6af9e1a2c27bd3b0ee1f30db5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c8f906d88c5c6528c11a8f4cada6d83

SHA1
f072d9f7cf009b7e78246be38478cfe4c6622a6b

SHA256
ffc951cd0f734da3e214607774fc00f9ad655c78666959f6aef49c272ddc2e20

SHA512
ab6bc922c0f81db014145817ca4c4de2369a547d651f10476e9be737e7e47bd05b5109213eea87ffb67d5292beea2ab1fef20463223081e9684c960c3f3fe14d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b5bd8eb8af4c18de9a1527fcb9ec2ab2

SHA1
a8cf6c799852e5148e85c69ab81fef7519466e97

SHA256
a43a7c496721f34f4022b19d44c8ee6e9cc5ba375b65bcab7a5c9cf730ec9547

SHA512
ff9e5b979e9535ade7a5a19aeb86cd45ce6bf52fbe30f3dc200869fb02fc9417bd0915f80ca449e12863648fe192487bd092fab42caca6cbbb6b002187c75476

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
656869700a9463d38ce44331afcab9fa

SHA1
e38d591b311c9b84082b777a62b4b2726b5b24a0

SHA256
ec460904463f70a68018de68abe42c54d7f53377ff3fb543cab9937b5ecd3c25

SHA512
c5c20a50f0f4bb2ed6f1b4f95c5064e8f75932b4397a45985c5de4e21da737190c5e0f562b17cb032a84e9230fc9be7e7efef9c8815e37cde7db870cdf0d7c3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43480675d4fec6ceb97388d45fb02aa0

SHA1
8ac6a22836f417f9f31dd0090156e2c2faeeae57

SHA256
3188aab92d2efc42a88193bec26f1d18271acf547983313e9637cb169f69646d

SHA512
0aedeacd118cf67e72ff0b1c79036a8d83209b9eff8f5573b607cf4b3a03e5e3277cfd769384bbb2a0ff70029d49613cb88688d90394ac518240d597d8d31e8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0af82bdefb865275dfb4279e0d152fdf

SHA1
f93294f92a6efe11e9d4d2cb0fbfd680a05f85f4

SHA256
e5464a7ff52f9714c03421cb3e36c4c75129f00a89df1dcca1419fa4664dd39a

SHA512
4b0e3e649c03596cd78b4ce4ba0393a9de20d971da8eff6f813644bfc1ff6a33b5521c110100ae827459c3a7e92539c2f4de8fe0a605e2a80a202565758d45ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc556f00a75e10a487806d7483dcfeb9

SHA1
6abfa1dc8b0fb5f68eb6b6c4e120a691f6783b28

SHA256
b6fe8ee6dd53c3ef31eae34dedfdadd14fb4bcca8b6643c6e507605db8d139f2

SHA512
adee89290b47a5a9658b1a3889ddadd7f8a7fd8efe0288ab27a6d992f4fe45c7fcdafcf366df8b7726ea422f7cf26d130c034a9387adc11245f4c12b3898b4a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bdf7bd1b340f3a8e9b9fc806b4222843

SHA1
92ae9a812ca6ef45214c87f0f9cc93cc3d5ed59f

SHA256
39fa401d5e1802842cc3986bf1af9fb811fb9a09b74efe461bd0a3163f0f570b

SHA512
2f17557ba543c2c08c99f2f3893d4df03560c849b036e3cbe09efcf6f9fe7ae46d43b813306696a7fd4c3d02d95252fa8109cbbaf468257d9ecc22b5d14da421

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2000.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar20DF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit