cbeacdcbda59ce192f028d82c7e44b6938ff97e1cbf7bb4156177b6231b67d97

Analysis

max time kernel
133s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 17:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b5a964f5100f29edde98c0cc2baf028_JaffaCakes118.html
Size

86B
MD5

8b5a964f5100f29edde98c0cc2baf028
SHA1

b5fe1d9e1808fc062e2ef5925201e656e48d2acf
SHA256

cbeacdcbda59ce192f028d82c7e44b6938ff97e1cbf7bb4156177b6231b67d97
SHA512

bea3af82362f663f88293220bc5d2e23c43924517504eb76dbaedc319e391f55a67ca3ad1611812ec904b3032ff964f41a97e5803d390385e0e96192ff819776

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f00f6a8416ecda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000080e3d4e0e4027734120137539a910a937357919e076d6c3b63405eb00b9d4b6f000000000e8000000002000020000000f818f6146d1c217f17cb67d36dd887f4e25b78f3b23185f51a6bf4774042939f200000007397251ba61a0b246bdcc96b9b2c07f7945b07f1a8d64ae0a8649df812e15ecc40000000210622dfa18b833d93b398baa9e984d210339a74e7089138c3761e59f52ca3e118bd88f0175ce922007084bb661981330424ed3d890ecaf5085f1ec1368a5a10	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429560278"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B000C871-5809-11EF-9584-DA9ECB958399} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000a9a78c485868aee6139f0cd3bbcd7722fa247b3e77e0ecf5965d29a910abc7c2000000000e8000000002000020000000b06a00acd653913f8a583efbe95536bef448218845a44bd1743902b9c1b9a8f090000000e87347239ac7029622ff79a6545d3183d4d155517ac8ed19faf126561cbc2ba5001d8461a6c0a1a14660f46ab1aa8719e3dd788476df914d6efaaf8071256652c94bccc721c2d63b1e1dd09e79cf058644424174684d3268f75a96e96894579542b047dbbf8e4b58d4f181bf349d7add147c8ec8ef7db63007a5b5c02cab4913c9e1de5c3d4d308b2a848e4fe53c740e40000000330ff96c9e597c585c946a5b924b652386587f6fbc9e5132930fa05ee153a922a13a62294d3b03fcca39ad952acdc2fbd1db2b735fd294d8091a5dbc1184e4f7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2292	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2292	iexplore.exe
2292	iexplore.exe
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE
2724	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2724	2292	iexplore.exe	30
PID 2292 wrote to memory of 2724	2292	iexplore.exe	30
PID 2292 wrote to memory of 2724	2292	iexplore.exe	30
PID 2292 wrote to memory of 2724	2292	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8b5a964f5100f29edde98c0cc2baf028_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2292 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c557b09bd0522fb9e3a1ec84f126f72c

SHA1
ac3cc5aa2a09b0c9320878f0acb4e13d63c88a55

SHA256
1905ce72b71d15030cd56daf6a5d725e4e1b26f677679632025bee0526fa85e1

SHA512
e707edc7ec559491d5bcade905e4e4c0fe211214e7b74079950dca5a6e873c02dbf2bb10bf4335732c5dda3d4b532ddc2e5d5b0cfb3ee82ddffd63b338d8e223

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5473476a7b532a66f5abfaef595eb90f

SHA1
95bca7406a1d8e96d966e5306c2c69e68a1c2d36

SHA256
ba254849f3433d27bc1dbfe888db127d50b77bca64ad58de9297fc8f7246f2d0

SHA512
3a456612c859c44b14b90456439be882584998c08cab7b764500c236e1b16c798461e8bfb25aafd94c9382937ee51e5f92ef1895b86164ba45daeae3519fe969

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a1fdb8dd587bd08e3f2319ed5a478b2

SHA1
d98267018e845c49846141c9dd80dcd8361a4c52

SHA256
5a4a4bb91d226424a719c109727c884047728e5cb7f7635fad2ca1a09ee80e74

SHA512
992bebb862b4bc31d342a3c9c2cc2cf23e5366e998cb334661226a761dbba5bf675a8be21c6ce935b564e207dcdc2515187981d948cb607d6f16ccb3e892dd51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10a9a1136778a9963f2318a197959856

SHA1
e0602a4886d7bb1cac5d51b85c46ab8adaa69e4f

SHA256
93a26286d3ae6c7cae33d60b61648ce28f4a01b42a04c1ad75de69f680929b5f

SHA512
fe7635ab24449bd56564da34e78e6c9e51da3c10bd574917abe81d62c25b1f0c205c54e58c5be59e8f2bdbdb9c0441b3c9d21940e574770c9ef1634dae156cbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0bac1f00280c62b686c2aedbc3f86d6f

SHA1
2da2e673410935d9427205b8851438c395ede3cd

SHA256
15a2d11c73a7edfa3d8563788d0f81c575c8b379bc49c8fc342892d13f86b220

SHA512
1b5ba9f1db3750297f3b72789c914bfe44f7638363ad56cac955d9388ae05e183a7de2e77e1733bc7625b926aed518c072fbbaf5a0fe58fe98e47cf804be603f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
697b7571a25c8868c025a9b1d5a82bed

SHA1
b4a3481a019c9e0de475fa25238ea5b846c40a9f

SHA256
6c599c58694e0bab16db6ba0cd98b2facf03bddad770cf2b5ef084ef0c68219f

SHA512
1d60ae573a8230a72cc4b15969ffede7a48c1875404fc12ea0742a32ada26a6e65ae590ac53f5d31f3dcf84cd1fc5e7164c41c82d2d69f6fa9f82d99abe7d90d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eb1adb21b8fd2cf9ada1832a8f4bfcb1

SHA1
02de2aa7d4ffa4ab9384e54077163b0577413288

SHA256
e1cf57f990be82cc2a3cacbb3bc00fe31f6103c5475223fb226edaee0cb187d5

SHA512
6a9e9c674f97d7a8a0e2260293a3bc37393868c9bf66f0b8ead7663b6414b979d094f0ef0400bb8cd786300dd899797ee913a661526a61a71cd5d326d64f520e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c218c3eab44caee79878dc2ff478d387

SHA1
bd12cbe54fca45ffece17b376c9c032f0e770da2

SHA256
68df808f9d8ef669651a203f689dc9cd91b898d8f450913d2b6d72fceb534064

SHA512
cf3045f386505ec709365e77d45b60f05ee50cf1ec2d25f9139d51792d699cf96c09f543e6686398a54d7dc7d871a962b68db5d273650ad366dd6a5ce1af5b2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c37a8d9097e1124f73cfe9bb1949cbf5

SHA1
563450ccb29a8a0ae268dce9899f13fd5adf9434

SHA256
d14aa1c90335aee92d74846db2b863549e9c3befd25218ec0a9aad662b0085e1

SHA512
a8659452c096b39c4b3f9ac0c9151563f50fff1722960746d79541d7699480a9b83128964d35992cb881e88abdb858854f50b84dedc73d162a3b26dfee5ffc5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92b65cec52d03ac7c599f3213deccf1c

SHA1
b821f436aebe5dceb7adaedc63a9bb9b20432b04

SHA256
41e78f596951f778376cc3fa695bf58c75f02bdb1659c4525fd10c7dbc45a332

SHA512
71893412a0c13333c6331c2ba4af2e40d4cbc67fec04c97e7796568448598dc84399442b6c81b83a9e26ba223286aa3c48eeb239fa37f10dff4ba96bf9ba172c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
daa215b353a1e3b9837160787a74c36b

SHA1
51d990d46c5cac18ddf9fd2d9469abc097158bdb

SHA256
c2cb9c10c6118debb265f4d90f57217bf1fbfba965a3f61f40770e7feff98d4d

SHA512
b566b150a0a5d81288afc3e3bc18c379751da04fc7179258e331f71446ea7a2f61c5bfb2574738b9c27a3533526623514985e96685c189b2202c0e410b5121d8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
969d16a95712923d2a2e991799673a5a

SHA1
7d5b15faa14551bf47735f141131be9589bf34f9

SHA256
7ee70d48ddd73ccd962e7bddb55d6c4b8509066c70d1245df73b3360ac3c159f

SHA512
16432b897bb02a583c37a1fe8af620df2d160186f645afb64f7af3f127c612e651ae355e089d6d62856c9c609ec5a1ce7a6ad9ab25ea61818445a7096adac687

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f5cca9c335482affff76f8c4bece266f

SHA1
23e394f1631e33edf4632be0f09bb9fcff1390a6

SHA256
796423af5df276c49fd0f7955f892e96348edd8703fd68049eace527d1a32fb9

SHA512
4af4e1f1120efe9e9150dd81d340f8d2d2132152132c7e0e75c1d84e8ea754b1a647b5b45b4eb64bfb83432e345c81362bce58e48704263124d34c89e25aaf91

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
07be8de299996cb05ac8706a77e383be

SHA1
0e28c2569518470a725bdf53db84d24ea6daa154

SHA256
507ed0de529452eb63f0c0563091904324d9e804dd55807d59ca52cad7f9f227

SHA512
227ed7f47f201e583c2a31f8b3978cce0070e13cebcc8ba0c31b6557d44659cd7e3e911db6a8b061fff38e67b8ec9709cfd03b3a69376841369e559304d387d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6921.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar69D1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit