3ee1733859624ea06086c907da0dbbd14017dd4f98db712f106bef25c209ff2d

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12/08/2024, 07:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8dcfdd0a6035025e7b2af9686b0d383b_JaffaCakes118.html
Size

70KB
MD5

8dcfdd0a6035025e7b2af9686b0d383b
SHA1

46fdb83850a9fd6e6227964ea4e982d0174e9b5a
SHA256

3ee1733859624ea06086c907da0dbbd14017dd4f98db712f106bef25c209ff2d
SHA512

99706e17cfe310b5c672766c3bbd5c0d4caf7386a70a327888b6c7bded96650595cc846577f1be439dfc98dc1c88c542bd853b1920d173d2b6fc994525ca391b
SSDEEP

768:JiigcMWR3sI2PDDnd0g6MDnCwn8+n4oT2e1wCZkoTyMdtbBnfBgN8/lboiGhcRfW:JgfT8+1TTNen0tbrga90hc+NnhVJ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf710000000002000000000010660000000100002000000079e183ae7e978afe4c35b0d50d192c8ea68ce8af78d87bc6371b7c2f0c958340000000000e80000000020000200000008632c9d84a8c42f44c479288d3cdf343947663dc7952a0b258caebe23d2258b9900000004e96a0bc785f2b33bb975e656a1248828fd22842a970fdb511d466e8bac2e2b1c09369cf9ec26880e5be7588af66a136641aa920a82303ec73c131879de1b520f803342eb969217461b7ccc2a910f34af5daf1d8310fc7fac1ff21bc9e7bfe6825773a7ad6cab3637866e7f0d93dd14beeb4d9abc76af55e7b4ca75cccd6409fdb91dde39013bc41982f7f0378c3462240000000c7617254dcc560c1782a8afeef23efdc26701d49923213dc6045b4c757e070c01054f6218074dee4cf703ca3fcd30d0252f28d2656be9baf644feefba9f1a5ad	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2092f09d87ecda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C7CBA851-587A-11EF-8CC6-7ED57E6FAC85} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429608851"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003125cc29be9a0e41b44a3d73dc8faf7100000000020000000000106600000001000020000000029fcf7c1ddb6795b5f706808f09656f159a7c54ed2c0f4abd013bab60c4a799000000000e800000000200002000000021c550adf90fddeb44c9cf8e1caf60ea32aee7db2c290e01b2ee2d890c41c7fb20000000e01f9bb9a699678a5af53fefe879e3931a5ce24f71297b96f911fb0339d7534140000000a49b92edf7bf29a50fcd835d5a70bf171c6fb4bf974738fe144222a57a0288fc66c7cbe2358fdfb444d46cc7cdbe21e5974d938c3ab3a40f9f92f8c4ed8a9aca	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1948	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1948	iexplore.exe
1948	iexplore.exe
2396	IEXPLORE.EXE
2396	IEXPLORE.EXE
2396	IEXPLORE.EXE
2396	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 2396	1948	iexplore.exe	30
PID 1948 wrote to memory of 2396	1948	iexplore.exe	30
PID 1948 wrote to memory of 2396	1948	iexplore.exe	30
PID 1948 wrote to memory of 2396	1948	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8dcfdd0a6035025e7b2af9686b0d383b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1948 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
16d76a690f790ebbefb729160d75f88c

SHA1
4806f30014d2071c814cea2e6328892a654ab9be

SHA256
d10070586b929184338dc6e4542c2520be146ecffb6e1ea3c2e571cdb5e26624

SHA512
ec55a54f4379f3c5c6ecc6691707a44842e7dec35bc592cc65ca77af56fdf8c5145db9d14917f7e7db946dbbe3724f032ac3f8bea68bdebb1d97bdba00feb98d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e71beb97c3bb771612081cda1ac4f74

SHA1
cbdc752d17cb6dad2e993ba25771400974730cd2

SHA256
b3a9e4e046ea208005079d46fca55626609e732a6d7cd6bf303fd26893a1d616

SHA512
2e1dbbce43c91ffb243886fd5969377e5b99aa36e23e733c96a8e16593801cd04dc43467d7c952e77adae9a76959670febbf0525e7f33c2a31623152f9d2ebb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be27b41021a8811089811a1be63af040

SHA1
c40904aaf47d98ea3398e97981b7cd4a69af4795

SHA256
eb7c8ae17948c2d203072fbc4e4112cf8cbfcb59202bf7ac18aaa2a2d15c63c8

SHA512
862e5526a4e91bf70244acf66c036fee2b7c970fd114c45c23fc916adac8e07d936ffbf4883d373be34c5c7407e1d9b284f9e4ed3f8f9af172ac17a0b39676be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
79daaca94d67190707a5ea503ad40078

SHA1
84d44ad8d6d79ac2c60cd102022051d411080683

SHA256
758b5eac51dadea760ff8985039a3a495e6737d160c14fde463ecaaf89724f5f

SHA512
5d0964ceaaefaa64205757045df0c99379cc73d66479d403581e4da1c00d904186b3eb87ffa689065e6fd8a4734380ac11da6c995a90847a6d530ed0080df503

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ce31a087b5d151731cfbce9a346e617

SHA1
72e5a96d73e4607d25ba5f33f328fd495fa264f4

SHA256
38e535aec203fe9db1041e451189d59f6d3106a1d3af09d2998339eaf81cc526

SHA512
612d8b24c1c701ca836a3b8368a3217847610bc5dc8b537455f6c5313f66cd3332054993bf63e0e6160313b45569bd2b404ed087ccc7e0b63fdbaee058c16a26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f7332120a663749e40ed8fea7ed4eb3

SHA1
883bd0d79b327153b1b4f9f481b7c4fdb8a3c7f8

SHA256
0b7495b756a9dd3c61079b4244d1402b253138fca0ef96752ea36ac37acbbf79

SHA512
a3946309baa0433796045cc4696468df4d149a7c1a3bf93cd2a1ebc3e31a75770fcab35305cad306791b455bbc1435874ec92094b9f4c4d7875badcc35930895

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bb4dd78bbb3a36a05a829a94781172d2

SHA1
1508cfc49719dab2142d23cf7fe92b505bb9967e

SHA256
35c38b9c3d8d0c59a8038d2fee14a447c53d2fbe6ec7311cfd79112874460ac6

SHA512
89b33590e6086a0cc9d335a1b9ec7fdf460de866b9564c1e56555fd4a21d6bc59f9f5aae95394a0c7590aab388d40d54c00a271b1e566b169d4896a037454eab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04feb9bde0734d1f4ce6793132988330

SHA1
2f8c08092c19c4446452ab9768c3a3f9570e3dbc

SHA256
0c69092740742d3fcb952ef40c6974eedda30fca45a9c466565bb65a08df1cd9

SHA512
2df840b3003e66d5db23eb3e0bb41a45b5b629669f25b4b2a82bad4e5e8722cc4022637db639995dbf8cbb0839578b59cf73aa5dad7e82e98b7f98761ef40f4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52a9f45e09086315928132e8cb31d553

SHA1
b8316461113faf194293f91cd514575663b61018

SHA256
bb84482732ee6f39fa937f33cf0c69fa7898edfd236e1d1e62f4e092879611f4

SHA512
c54c1cc6eaeea9a48140e45d647e577e7bb3e7e55dd4ae251a75688185fb45090b07a6a21db8285a918dcd5219e7e862bd451828080b929f19ebf02560c45ca4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
21b335681f770162d84e7fdd5075603e

SHA1
d56b7e40f96bedb9820ba3e4e8639950c5911c7d

SHA256
8cd32e09930019fde8fe7fd74841f76c746c7778b478e12c34c4facaf97ead7f

SHA512
5306eaa93240eaa09fd5bc671adb9a478f93d7eeccb3bd034d4ea427c8a72d21fc8bf67cc9e6cb8b41fac4c4b6cc62a2759e15d9b3a11aaee255627e3255a870

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8fd7c0aa68051f4fd9c92fbdb4670318

SHA1
7157e21a57e3db0713368ecd74d04cbe77a5b46a

SHA256
4bb99fc98999ddf6bdda81a8be977e67499be4e0b048f1d21d9d1019996b02ad

SHA512
294b317628372503c7d7a8e8771ac656a427b626e1bde2b90b0facef29c73f908e5d8df65c794a59eefe55b71052f1a58447cc87560ff07d97ac0a374efaaac2

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD858.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD916.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit