1836ca2b581c6a69bf1cdfae79e30c6a0866435c2dd28dd363df8e84edaca19a

Analysis

max time kernel
117s
max time network
136s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
11/08/2024, 20:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8bd3120955621b7926d6702b7162edaa_JaffaCakes118.html
Size

25KB
MD5

8bd3120955621b7926d6702b7162edaa
SHA1

fd894f19905e7c51e828a2df15491de8aa0a19f9
SHA256

1836ca2b581c6a69bf1cdfae79e30c6a0866435c2dd28dd363df8e84edaca19a
SHA512

184cb14d3343d9c5a78989b6020ce7888494d39e650d7609b5b297a62b77f48b97592e603cb2006c6326037097a0b15d0a1c508228923d2dd8b36c07b5cac064
SSDEEP

192:hC39MjaUaWgUxJf959k3xKObVmZ+d80FaOcWafdAWan7akX8AeR5aosMeav7azW/:/J159Rwo3hH29GdNb8mk+Uq+WXnRrHmA

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000bc2f4fa5cd476f7c695c6fe3648be6f149886ee77b37fa49acdb04049afc9c07000000000e800000000200002000000002d0d9c504f8012746bd55b0d78cce1703df26f64cf8faeadfbe5c1dc023bb7520000000e8260fff4060ded948d278c1427d9a39cb8ce6a54897ef6d8eee7e26c92a1c9740000000efad1526175be76c9a22a691e9660e59694243f1ffda57dcdf7d400e4671b66c37c920f4a1fd88defacc9cf445e01fabddd6f144784568e949c994d53e4decfe	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429569525"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80d1172e2cecda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000e68c40f25f2cfdaa16f578c98a02e7a889f439a28a530d402a732cf08ae7ca58000000000e80000000020000200000009ae0223ac9a01d8c633ec6aeb86a13b98bcb92738ba0548464a6fd3651b9eca590000000d3ffcec8cd625229d24239115d720f6856ada39c80a5a95e41b0defbfd21718137efc2d5e9c12e57036891e28d9eb75ab964cac2e2a02c119632bbab1c17d058a8b13b954e4b95bbb90d3f6c407c3e689c12977b400c628d52f021c99bbb19c3b65442230b7f90909bc28b9cf90fdaf96391b5e7fcb6859fa69dddc405f2408ec5ae7598d82a746bd2869e1afc74617840000000499db2f9acb23fcbe311493034f4be111f3904ea4b3ac284103c9473c8c4d20fcb78fc0f63a62835de7155b829b42859aa7d86d0befb868ab9a311981248f639	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{32E994F1-581F-11EF-A550-D692ACB8436A} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2348	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2348	iexplore.exe
2348	iexplore.exe
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE
2208	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2208	2348	iexplore.exe	31
PID 2348 wrote to memory of 2208	2348	iexplore.exe	31
PID 2348 wrote to memory of 2208	2348	iexplore.exe	31
PID 2348 wrote to memory of 2208	2348	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8bd3120955621b7926d6702b7162edaa_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2348 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b6606cd4ad79f113e63750c419c5bf52

SHA1
c69b0cb86c7e7c8709e71b7cfad99aded2f9ce48

SHA256
e2c4a7c10b6da09f00a9a689b878dc0d13b54449fdeb39ed121a3692169afbb2

SHA512
bbafa38491aaf363420b6b0d34880a77548a4bca67fb86a6574e1ae0090185b564483baf2a32cfd860784201b4365d7be745e0ceecebadac7181febaba8e212a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5472c38ae466898d8cddb61397966ee8

SHA1
5904c8380eb804a4189bdb25f47452746a2f3b40

SHA256
d95d5bb520b5cdad41648c0c0efe6088ee84a4ea0de6b1518f2ea96a88398b22

SHA512
bd76949e8b140f17a052d42d7579232b1a990b4375489357eacd90dde5c4ddd61fbccc641ca29853f2fd8342958756c0df7cf99b8b99759e7a39608b43056803

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ed41723fc080ffcf15250218545db02d

SHA1
9f11d8091f4921cfc495237c7fd5c058ae5e89ae

SHA256
b5e2db75b33f93305b2f21d9fa8ac5f7287cbf3910ec806a5ff3759776f83840

SHA512
072649a903683a9d501dfbede1b74a328f0a9638f0b90ebcfe573670e1aed3a108b588f0b0de8c15594ec167152dd97f9becbd3d92d789c226381451b7a51268

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
9fbd10c805b6046ea15a091292ee4268

SHA1
5be8b1e1313f385794432be4a63020ed703a8618

SHA256
e27a8bf0989c9c8009a317f339352d6aeffb38393737f5bf709a34e8782ca829

SHA512
da925bbae40b57a1a2f7a92dbe14df40b6384f3cf03ea579c410c9ce16d738f71226c672260f3a20a5f46ff5021100b24d3f94caa85b5dd1e929d964a3396acf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d68b5fdcdf619a2900f0d86ecea9794c

SHA1
e6e78cafaafcee9b5f30dcce7f54ab1356216fa8

SHA256
4228605fef78fc0d43a7c959f314ff9ce470b1683276e285f986c617e0181099

SHA512
bc87ae42782a000905ee33e4b308ba48f6cd93cc215d58d80f767440d8c4985ce4b3434535f2d6fdc1a89a78538f77cd937d05b7f720db0b2fd3077456e90924

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0dd4ee5673b4f685a892be8f85bbcd4a

SHA1
7b7a6f9eeba6bbdc5f4d98e3851eb7811b04edc5

SHA256
9346c63cb1cf9e0072c4ebb5c0d41a0f92c29863aa43a7bc89b3a60736788a63

SHA512
44aef0d65225897f6318b4baac72d882e18ffc53868364ae510add86d2f0d3b306a2bcfe9c91477840a11415842a196cf7c0baf817f58c6a92a0e8bace5ac978

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
dd64435cab4e9e3d9376b7f2f0b71243

SHA1
225fb7515ddb7bb8e4bb55e5d312230a7eb48ba1

SHA256
955c818ee0cbb38560bdede6077091dbd054a59b567f3e106d29642a6ada748c

SHA512
db020258abe717b33edc145ec34d5099f78239603f5639af18d10eee615b6e7f755bd3451fa3865ac14a1c17dd9c69e4c8e4f4f1030192ef61f5c22033c972ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0e69c5af6ef4cd87fe3e3225f88084d4

SHA1
faed6cbfbf2354304298837e08106b43ca936dd2

SHA256
a141eae1bcf22d09d95d7569f3a78415d393996193556fd4bee11ad50e7fb043

SHA512
5f58cbc6de03276f209091ba364b9a6b0976b2a450d16ea41adf4156a2586a26ea2288b32d642d8169e86b9b4eb5f674fe92e22b28cb28661b5bb2ad218b7eff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
b615a82ec419e73299d99bc41f0af0f9

SHA1
ac3e890ca57ef95864d56ab9fae4e4166a26fb2c

SHA256
766d497bffd815d95beafdfa68a5c8cb91c9e1f724b2185b51c3dca7893681d3

SHA512
c9b56466e0ada064c7aa10fcb9348c5fca2d07efb40af8a44e0e1921673f433cdc61c4d8ba13c552b0ad808c6d9b6a572b3615d4d3c9a26fdd9d1e4a0349c3e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
efbcf66eeb67628d28d3a891c68c8295

SHA1
7dfc17b7a5eecdcd5a6662d885a350bcf2241661

SHA256
09e4a606dd8b3c3628904175ad0f842bf0c1fea144001a63e2f360fdaf3bcae7

SHA512
65d3ab922bc5f23c3b9c62c58ecba406f48699c29995a370c9edcb529c733a3d0ef8165ea4aabb7dbc3678120e82da583afc25183ae63df01dbb8a5300e853c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
81f65b45c7c599889d148f86a17d93a9

SHA1
f901e12c9501c6c7881613d7145bb4611f95a108

SHA256
83431f2a93eda1f68fec603bbeae292b13959c544124a7364cf4ff9a7b3c5451

SHA512
b0696fe5deafcec0f2c961120f9d9933587025af9661c90e780fb26883b2e3ebe9f00707e2955d94440d9454876d0670fdb11c4200a5b7e7490881994b5952a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
dd2427f2e222a272a27f575250401703

SHA1
9e6a6b7c9b3a15428ab6e9fd7b770b71c3c3ce58

SHA256
63791e6d924708c1d1e1b9b27edd04fdedff27faa0e16b06601c6c6262b5c777

SHA512
f7b5ffaf7dfa88991bb79c2553d35bd74a6f2e03d5f2ffbde7cf0f0845282d9c082d069e34dc930308c56f43ab9bb679450611cdbea478bb200ef41641ab027f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD8A5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD9A2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit