113ee00e389c4725cf5842a06db9ed496613ed96b040ff0cd50ef5d6acfc4453

Analysis

max time kernel
130s
max time network
140s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12/08/2024, 03:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d39087a49008025e31d1ad99c83beb3_JaffaCakes118.html
Size

23KB
MD5

8d39087a49008025e31d1ad99c83beb3
SHA1

90014c48539bae5ff21293612b1c2dc36eca3cfe
SHA256

113ee00e389c4725cf5842a06db9ed496613ed96b040ff0cd50ef5d6acfc4453
SHA512

61fbfa3220396241574e4b2233f123bda9d4f61e9ed6233f912dd8844811a1b5ad7114f7d3e63b4b4aba8cdebd805ba2966547844df201d58eca552d8013904e
SSDEEP

192:uWHMb5nC9U+nQjxn5Q/AnQieTNn3nQOkEntc6nQTbn9nQVCnQtbwMBzqnYnQ7tnf:uQ/Rmw6

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429596872"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E3CC5CF1-585E-11EF-B5D6-E21FB89EE600} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2708	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2708	iexplore.exe
2708	iexplore.exe
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE
1728	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2708 wrote to memory of 1728	2708	iexplore.exe	30
PID 2708 wrote to memory of 1728	2708	iexplore.exe	30
PID 2708 wrote to memory of 1728	2708	iexplore.exe	30
PID 2708 wrote to memory of 1728	2708	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8d39087a49008025e31d1ad99c83beb3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2708 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4e70ce89db5a6ce9e48159ba2a3e56d

SHA1
e2c869b083d66c289ca14d51dd7612c39fcb9e09

SHA256
57058a2be3a50381e37751555fd10bca083808635bd7c1b2e96357be0aa182c6

SHA512
86bfd97f57ee727e4a29ddee5e355fffab39f5898f4f6420d65dfdfa6c81c256cdd30cce97c91861293d4485849c549756d32b64b9fa6313b3bdaeb85e539ed7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75643acde1c895b739651f83d0163fde

SHA1
3b7787303e9f61ebde8cbf46e432191d61aa50cb

SHA256
524c4bc8f3fd138880cb45c9165deaa69dd134c722b27f8ae246c7c24af4d029

SHA512
cb7933bfb1ee16062a9bc75256a07fbcc23d968606f1629a594f533d043e243e648f1ddb338a37271bce988a03f8bc63cef1610944b01c09f8a2b59bee098d26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39fa199f4c5a712795d803193842bd63

SHA1
9c528cc46cea138e20e30ddf9198958794690bd1

SHA256
adc629fb2b8a177292936121e8f1f6eca0fa1c293ec68ed6825d4c6836e4b719

SHA512
1c7072619f11445936b1c6619f18b51989058ed3fc0b29b8894fa49883183b8346c0e6aaa0169def7d1e8796e6ce1065d41e6423ee0ca872b39a550ea9141691

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a0add336aab026080f094e28190812d0

SHA1
b3996a292aa1983c8d54cc184bbb29469ebddf81

SHA256
3f5ce0c509b8ca8c25e5c65bec19d14f89ca2c6927a78e9965886c4958af8683

SHA512
368c4c8e3c8dd9ad479517c578796cbabb647879be54efc6217b55cd5d4e27d9ee462cdc460a131efdd0858518bc00199fc6c74b500fc608004769e9c7c74a6c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
75a21a2436fcd9c22dc0632da904e319

SHA1
c87cc50196453512c868f83709e48d1bb8a2fb6a

SHA256
c5b26675851fdae69e914d38d8276a10d3978812c676d11447a5528c5e03bb4d

SHA512
890e85cd2b61fc05399dd3cda0bb2923ab41cf0bb088999d0922298b343c0b5075316c239369d52379f573a1752b1a32062057bca0eef82a7157c094b998e85e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ef3ee8c90fda66db708f5835ff58a50

SHA1
2146d54b03a83b8e459078b463be929ec989b163

SHA256
28049985fd7926943153c77593695b097cf739b37317d50a7d5ceaa5ff613364

SHA512
4a0cae0a3de663c46a10c8294257762bd19e44dca52a02f9e20e46a8403e186ee6a6816dd3dfece45fbe9c8c9e3f4f99c2840b6239f654bfc6198ed1db7d2072

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
537a0fc880eab9a27c3bdb704274b795

SHA1
e545efceffc0abc80a3861818a500986ced52f08

SHA256
b01ae45ed854af50cb89f11de052e97214be318bd32632dd1b882fdc18dacb2f

SHA512
9f1639893c358736e77b65365a33e6374b21259bad24cfd143dae7fba0f946459c250eaca1ecfb0837053f8c41f73eb52a50d1e41a1743819fd4b5654ce11926

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38fa7ddcb13f6cd58077d596c797c719

SHA1
1f857e1da4912edf259a3b42d8fa58dfc10ea384

SHA256
444f26949d290b90d058e369f00603d3cc41f6f610c748c6c666ec7fb9f022d4

SHA512
83dd9648e120c80551f0d66f111a1ad5c1935703c12519649df1161737e676417cf90c64d74b6cb6d480ad705344dbc4817971f40dfe413bbd1c29a6a93e847d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3d548469222c2f5dd4f1f85999e95da

SHA1
4df795877d22f21fac51bd17cd9bc96bef6c8f7b

SHA256
4c625f610db343758fa77d5497909fdc9a2793d9d333287514441f705d73742b

SHA512
2fe5a27b3415a3b7e73d110dd76a5ed953789722358a8abb9e26fa50429b8425a0710e267eb3e6a03fc080f51330ed2b03db1c9434ebd2cdc4be2b4e1b233d6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBC5F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBCBF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit