1de14137eed64b25ba37abb75b9d120b5940c247eb81377663ba9277abc153d6

Analysis

max time kernel
67s
max time network
128s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
11-08-2024 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b62482b9a5269d20c724b9b2c56b74e_JaffaCakes118.html
Size

6KB
MD5

8b62482b9a5269d20c724b9b2c56b74e
SHA1

d5e9065916c8ab6485bb42d1c2f69209e442fa5e
SHA256

1de14137eed64b25ba37abb75b9d120b5940c247eb81377663ba9277abc153d6
SHA512

2890bc0fe495e96364e1d0fd9ab9a24ac973d9b899060d78b2418cc0ed7e8584e14eda2a6735d6e91edb479d17585cda01cab32b7aaef39ac5dd22426fc79abc
SSDEEP

96:uzVs+ux7mHLLY1k9o84d12ef7CSTUHZcEZ7ru7f:csz7mHAYS/Sb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429560853"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c920000000002000000000010660000000100002000000069118b587ca8773882e678e3ce03afe08c9524eee50625418d001618d56c5fd1000000000e800000000200002000000091e6aa4755338ea5df5231e9bda8d7cd85bcc9f1175e72d993b74747d932597420000000c5d027589aa0d4889990ea5c3a9a168330e0e9b2ac2f77ade10cb7a17ffe578f4000000066f2cb91ba31d346385a8a60b08a9a0689aefc0ae641ba3a46af26119d2c51a1b78b7e5a591d9e45f75e0b8913c8ee9ab81a3e1a931b07d76b24312fdd7304a8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c9200000000020000000000106600000001000020000000d95a78049531809be32df863736b2049560227202948b7ae3f9ad8c20f4e5009000000000e80000000020000200000002c2a3c5074d6893fe11701b90b1c395fd389c52ced2404d10ebfe70afe5e4be39000000064d7ee37d8da90eb7a2df73ebd85652159c3c862c050b7f8e82c8abbde2086635398d92fc52fd9cf6ada3d9d6c85632bf67879349945d1a1c0edac35f04b92f7a82726c95dfa09385b1160d1210620bfc52da3339867d2d8d8e90fcbe701d9e81f82c60e174ce23fc2f2cc218fdd6733499114d94b711ca0ce446a5b4389ab1d0e43eb0788399791a2f83ea7e9e56f5b40000000eba4122aba2077e295e805abed550f7adc164cabd8b48a32d23d033266d2cd5a1b757edfd8dde41476f45ff598586758a0669507cf2bbd113bd33c0de5b11c25	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 605ff1dc17ecda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{06C7B2D1-580B-11EF-9EB7-4E219E925542} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1928	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1928	iexplore.exe
1928	iexplore.exe
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE
2440	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 2440	1928	iexplore.exe	30
PID 1928 wrote to memory of 2440	1928	iexplore.exe	30
PID 1928 wrote to memory of 2440	1928	iexplore.exe	30
PID 1928 wrote to memory of 2440	1928	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8b62482b9a5269d20c724b9b2c56b74e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1928 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b80181c8229849fa2c86c56d2ebadf5

SHA1
d7e7569d59d1ff5ce3ea585a3c0d345172b0e8aa

SHA256
e10b5512213dfcb95a45f2ff6fa5ed63d98a4fdf7056557d78c5217f0c34546d

SHA512
3c494b0b681b1e714bec0a07ae1f01ae2ab799dc294f98721f31bdbbb823a6c68d12c806e4ace0e1f3210423ee41186380ca0e266b0dc3fb6fa05eaf9ebca096

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e99b05ea8791a98806fc3e8e8fcd2ceb

SHA1
7f2d63a280ca8247be7aecc31ef6a619cf27af16

SHA256
5bee6e910ad90da9c099c81307482dfa83905e8058748167d3daa521a85a3cc1

SHA512
bcf6d263ccff6c4ff098bba5eab0257252b78c872a8152d064b9456908e8004001322285bcaa338178c60def4da10584dc051d4f122556a71a8fa17c70721573

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d45e2f56fc0d8d7e0cd964835f49a38

SHA1
3686cc161cb2b5bcdf9f29829107cde439e8324f

SHA256
187bac3742ec8b8e1c6ad62f50a3e752cdceb895fd46481878e265e2a5659400

SHA512
b557b96eff82cfb468016ae34d87d06bea39fbd180bb4009b7c3d98536dd0fdf2c4f1add413d0a753d3254b4684069fab2bf9523a444aa256949cd7cb64a1899

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
babab93dbb4e5e0ae8bc3d73cd2c9a53

SHA1
ef60eaf1d50614bebc6039b5407ab33984f85d03

SHA256
72e72f38653d5f4f86827f13a3ab9c328d1f2def61d7c913ee8707c1670a93da

SHA512
3b69bdf0bb55b6f208ebb64ea185cf78241dd104db068c46efa1cbe01ead73ebf39415c8a453f5eebe687ac0d523e466fda139444534ff2ae8dd894d11ee7fe1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ecc876038e6ce7860c9b63c30ff81a21

SHA1
de18d9f30a8e1341d8c0a40ecd4487ae034bb9b9

SHA256
64d138383ee9091bea9977284b86578d5ae4817198361c97ee6fde0ffb1b1bfd

SHA512
af5f3f81928e650f252b7bd841ad14c04244f9afbd046667113fb48f6bd8422497beb959ff1e70cdee8a1ec89ef194698577dab6615ec1abc3ac270ce4a52e60

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
484178bda3994d202524994fe5bbf8f3

SHA1
ba324f03cf1f20675b53ed0cb190b113ae97532a

SHA256
ab9f0d37ab8c704ae74b5cacac31d401560db0309eae2831dc5ac34d5b08d489

SHA512
5f1e7d4cb578b0e525e698bece509f5e9dd638c7ec3285b61331cd338604b37ba52a662545532044195a7cdea27984cd56f69890019a7db14a956221a2b59c42

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE9B5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEA74.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit