2d9ef85670ef7d4e1b2b78796faa662fbaba36bafb8bcde371c16c62374907de

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11-08-2024 19:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8bc128acab872f91777b7b85ccb7feea_JaffaCakes118.html
Size

6KB
MD5

8bc128acab872f91777b7b85ccb7feea
SHA1

7a11f72dbfcee2db02fb43e7f446d7a06c75baaa
SHA256

2d9ef85670ef7d4e1b2b78796faa662fbaba36bafb8bcde371c16c62374907de
SHA512

ca9ce43f88faa649c757bdc2c61f07c1f880df5ab596321b3f1f59df2bed96acd55416fca68186893df41eb69c88335c653f574008714ae80a6a1aedc94f7569
SSDEEP

96:uzVs+ux7yMLLY1k9o84d12ef7CSTUpZcEZ7ru7f:csz7yMAYS/0b76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 806b7adf28ecda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf710000000002000000000010660000000100002000000015b1b83e44fa9e7aa57429a41bb48ff39270afdbe4779e85aac4d2aeaf8fd40e000000000e80000000020000200000004beef930e4037676183a0875e1f90d674abb58a5c872e81df079728fd33fab4090000000b53fe8cb48cf80a81ef5b91b08f0168fbcd3d4bb6ce43b657d4cc823a62df46a165352ccb997b2e45dbfa2a676b93ee22c80818015a5b635913bff98c05e9052f4be9310ff8ace0d79d1b3b7ed72f05338abed2cf49935aa4f5512c067e7df74db342e36888164871ac56dcbcdef7cc26a51df379eea460dec60da57c56d3d17befd9d6aa936f3c72b94e46ef751424940000000ab1e33e88f9a32c370ab5dad4804d87585e7d42fdcdcb0dd34101d58111808331bc05d7634671c63cc5f996125828a2aa135e5bf3a2ddd25d79d1cb47c362375	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{08E848C1-581C-11EF-8CC6-7ED57E6FAC85} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf71000000000200000000001066000000010000200000005a6252342b98638cb6e31d42f6ae8bbf76549817310450a02bc185e319716b05000000000e80000000020000200000005fb5be00c444ce15acb0eae681cc1cc501951e001cd6d0e4180585f92e0cd9a220000000a49c84561a7d1fba78b8c1191054fa74c9aabe7328750d3a29cca9495805c26e4000000038fe07eacbdc1168f71777f875d89ecb56a9bd6b0055ffe2763c064d5c9a49fdd16fc4f466203148fd717fd2cdd1882b6cc8fe2e496f92106ba554cc91fbae1a	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429568158"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2384	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2384	iexplore.exe
2384	iexplore.exe
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE
2884	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2884	2384	iexplore.exe	30
PID 2384 wrote to memory of 2884	2384	iexplore.exe	30
PID 2384 wrote to memory of 2884	2384	iexplore.exe	30
PID 2384 wrote to memory of 2884	2384	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8bc128acab872f91777b7b85ccb7feea_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2384 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dcc0adaa6431fa280adc6132d27efef5

SHA1
a06d89e6961dbe82dbd19f535ca744205cfe17f9

SHA256
4d7ebe2bc459e8cd9880530569a678adbcb992a9ff402a19557e644174b6fda7

SHA512
f67b6f8de0adf57224c44bfa02fc9a4d55715f74956a3c5110bfa9f87491bcda80c7eab66011cd8bb5098a1d8a48615b8109acaa2e71135e34dee6d268a4c72d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60504dc4bbac08811579cef7d650f17e

SHA1
d046b209fac66848543f7572febfda90a7233182

SHA256
70cfd0f4a99b86a4127478effe33b3045181468960cd3821f94e845ffa5dd03a

SHA512
d65af6ac8a592c0678bb104a5ad67d89e223acc9d929547b62079ca0b257e2f05bbb5766c96427670fb75ec7b4f599d450de620c72a76f0520f70815dd129e37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f59053e534d523370306cf643be9e020

SHA1
aff173dc5cf2ceb4e1cabe437adea707da99e3ee

SHA256
d72558cd23aab561e61aa2a16a5764b11452cfc506aa2b1cbed3847b518fbaf9

SHA512
9e9fcf458b036af0cb9ec60e98a934eac6dc4caa0982eff511d3af8c5d57cc9b09d982831309a6715681db33affe8a5ba33b8db7f88a7e5a9e9a56991bbb4cd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6530e43f0a4eb3dd0a2e8a83608b70b9

SHA1
653d382a18fd35c6acb1193b71567d9cfd874571

SHA256
84d39c3b24debfda84f57f417d9aeca0b391dab7afd92ce35c2d6c69233d92ae

SHA512
324dfe9530dc515d64716f2d3f4dd243fb5115cb38f1693eee6134d7d8e67c5e97a33ca2dc1c27011c5f96242c33d298c54e8735b65754d4808334321ae38a80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d02a7e2a853b8390495b20bac8a6044

SHA1
a64d98bd5a3763de4f2ab83a9843021721f39fc8

SHA256
f9d2c3b3ca901a326bc4d11fed0890c30ab7aad82a8e6df27958ff14d614734e

SHA512
eeeeeee96bdf8eb5063b5a1380c54f27061baa703c01b0ce9440e9de04b620f1fb41788be0ce96d952ff3d332b549b3bf02466049b991ff4cc900ced606e912a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d87168b31c17465bc7a45ee687b0fb1e

SHA1
9d3941dca0d85898e68fab2a4ab85398537435d3

SHA256
fef08b2568d60b1eff66500e4e6e44fc4345edec29c6188bb6761d458e335527

SHA512
60d9ca4fb53f2180f00f3baa7b126925401b5665e9211c89160ae571f317983888e4c8a7f8934dbffec52803d696a4cb7c364769e600708dcfe36c4e3b18e38c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d62dee3bcfde82f1846b4bb699706405

SHA1
bb6737346e75c9dcd62678335f86e58b92bdf540

SHA256
6c3b9d8cd93554ae0618b0596b908d442771dbc1f55af9aee897f69a5d54a64e

SHA512
94fe42be5b3d9274145a63102400a38e6309bdd820e5ea971edd08591e35b3d5cb5b6ba6c5650e084b1e13663fbab24faf6a9aae3247d9043c7261fcb52d9598

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
70625b05c61a94f44291a6513770fcee

SHA1
4c350d55aae02345bf044e3487c7516f05f783d0

SHA256
dfa67f221e649dc8bb637039dce7144b35dd03ef4373247c27ffaeea8a6113da

SHA512
6963bf14b3aec62364da88aee4883b3153259dbc3350cb96cd38c36df958b66cdca6f4452836e247a5a94d560de84139726b71013c9ea682af157ac9f3fedc4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3829e50e4a50f5d95d049248b365505

SHA1
aa528af8524559d332e6f29758f6e6b10c15e985

SHA256
aa445bfdad37b3866cf0bac0706d23f9cea53fd97b01b49a6c746088e1290806

SHA512
8959176a8d2216020fc8f55c61ce22e05c6aeb826fda4c4adc2f0f2023956cb8f0c60daf14b0e457ab59a5a64fa9b39755f0226022add4b1569b9162625208ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8255f652b9ad5733ceb7270587b40997

SHA1
e82481d29b771838a612a61289d4b1ca18ab74d8

SHA256
67ac3c25e0b0fdc3074f8ade6424b22a04a236407a605bb3cef211127ab86e8b

SHA512
aab21f8cc9b1cb294feb8855634953f773aadd3337840a7f83f032b10f1c79823a752269f31dfe60143457fe67e08aa0ba2a34ab89729e3ed52148f466c39385

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f8d7c1158903515f1277c54c2c933a28

SHA1
7c17fab097bc686c6e7ce9a6ffd466c02d3923df

SHA256
6c38e2ef96452862a896a683f1dbfdd44c8147ff70089d47ed111aef52ff06c6

SHA512
921e8c9a269ffd2a4269b413fe09c8813b5fec50449cfe6d9326e3d01634569b29aa2d7813db690a78df3078bc4e45fc068b3d36501a89659cbd7a88dae4db1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDB53.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDFEA.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit