464dedd14c90efa48326916f3b51739e6f58db6c5ab42dc00d0a681d8851b77e

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12/08/2024, 09:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8e280cbae307c631d0d53b3b849eb6a5_JaffaCakes118.html
Size

6KB
MD5

8e280cbae307c631d0d53b3b849eb6a5
SHA1

d98c5e5fb753a2ae0784f32c3b5e0cdf325cfdb5
SHA256

464dedd14c90efa48326916f3b51739e6f58db6c5ab42dc00d0a681d8851b77e
SHA512

0132a504a37f2f408a6acc26dceb8c54bd4d636ad70cd61f0917e6c2237aeb8ebb446a41fae7fd2e6a0b64a9d5ff015c0261acd864e4aed5203b6f52f56ff08f
SSDEEP

96:uzVs+ux78bLLY1k9o84d12ef7CSTUGZcEZ7ru7f:csz78bAYS/Vb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000bc006ed3cc10b307bf227cb27fec310a064df9ab096642b4118754f9486b9b48000000000e8000000002000020000000b6678819eb25aaa5748370de0d8feddd34848288fe51667dc0e51c391885e7939000000015d31bc7866bc9cd5741bc846c4de238e9d69cbd9129be7901c37e427bec1260647740146770a9058009791299d2164c2878839feeea2f3920f622656225bb46c7f40af61c594249544948713ce6534028d2709b46ca759ae1a50aceeecda2b8836cf9c67d6dd95c0e983364351f1d9b5026d4397bb3bf98b7decde18f2867c2c8841b2045fa533f416e2c894700e0524000000071617316431475699c73a33f520b24edcab9ecbca2867e7db7045b905012137d8ef04e622db06eafaa0bcf2194c2ccefa545d2ba8660394ebadbf4924f2a63de	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0406A711-588B-11EF-8419-5E235017FF15} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20477bda97ecda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429615824"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000ec42f2d6b6bd01a014b3758a70e3cc01aa55768dc906ec8ffb3933044126fb4c000000000e8000000002000020000000eaf59baa2d002cb94399c318874e1763e021b735c4084d03db6ff587be85a68a2000000040045b432f66d37228ac1d6b4939b75c4364349d00bf67c7d21ebd0da2fd807a40000000eddce503e7784834d2c89e60d32dcfeb7dc70abfa1fd154035167adf8ef8f1f8d3b5d8585929d355cde79732e1ba111f4edb3546da8b379750a1ec0a6fab842e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2104	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2104	iexplore.exe
2104	iexplore.exe
1544	IEXPLORE.EXE
1544	IEXPLORE.EXE
1544	IEXPLORE.EXE
1544	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 1544	2104	iexplore.exe	30
PID 2104 wrote to memory of 1544	2104	iexplore.exe	30
PID 2104 wrote to memory of 1544	2104	iexplore.exe	30
PID 2104 wrote to memory of 1544	2104	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8e280cbae307c631d0d53b3b849eb6a5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
196662e1cb22ea7425fc6c8252cfc2b0

SHA1
fa3db60d89fc11bd8734c99c17a9828e655ec26a

SHA256
7e5332d239ef0526bca6906e42ea0a8a52a081ca76d02a387ee9c876c9d3aabc

SHA512
0df4804079a130d3ee7d5629147553350e17c6abef72a700c207ed4fa73feffb80b42e1ab7e868d2c63ec40de406551169bc06685f891c1b13c778fd1b4774dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc2c37f9ce706ff1147305b499e6a7a7

SHA1
6666b070f2f2ea538f76a428e2b0f47af01bb013

SHA256
307d007c0636be1a08cda1480242540e1e4684daefa2694aad54e986baf78a2d

SHA512
147c968c3f05c40bade3eeb4f4bb835a686789272ca7a5f670e0181c0a43dfc05b051176f12a54b259bd3e545b324632325a8330bc20e94f87cbedb4b2235929

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc3017547e4202623980f28f411a0f2a

SHA1
d371696c666e5565e3daed9b4021b50e1d93095f

SHA256
8d491d2af90071c6cf4eaa44fff36a92aa7271cf26208665e9a33afcec6b0faf

SHA512
babc2a8419f87b600ec7a7cd27c8e989cd8b6b28c7c379f9decbc6624e450b3059eb907153b3b75b6bd5be1029ffd4ccc81bd787022aa17b762e7cc5cac79ccf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ccb4fcfc90bac3f4e713d3f0bdff7702

SHA1
0ff60d6ff5ba1cfd4f61da1b9b6489bf2b87faeb

SHA256
713d0572a42414401f24a642449cc0c7ec14c3d2701961a15ee332e4bf7e2df1

SHA512
7bcc8aa41ed088295fbb0fd0a31530db89a3e3c62999d90debb1f65b97a83630f169dc378526f81894d45d757f0d0af62a28cc709df0cd4d33ca770f61a9df66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d321a858f04f5c31c12955e7759fc58

SHA1
c489015b348d0928ef13cb24753441fb35fad033

SHA256
6c506bd1dbf8500236c09f5bc1dcdbce52cec71d0767de63e8f8659a81a1f059

SHA512
633b211d07b4a7e73d3227ae6810da4b0fd6aa1ad1f66f4a7ca5166aefb73071bfad92dc9e7dbc1ecbfccb6d1d2d6fda5d70ac21254b1e7718b2a7b1beb5c6b2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
edc68b475aba8002c2f060a96b363fa7

SHA1
f5295c91e27bdf618b22525e1b4e9b911357fad8

SHA256
bed11038ef1b73dc665d14d0e93c789a3bd891d609a7f5609f3ef39dfcd97135

SHA512
1b79351a0d5ae51ee540f50399abdcb33d4dd357be3f8776999e9c78cff02f45d16fec61455ee610f2e92fe3782f110783be3542a402b61748e08b1b2b463d1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7ee0238e228614183c8dec0457882a88

SHA1
0d6eddb02e98b2fbc614602c70f89355754f71e1

SHA256
8340e85287d2acc59673e09e109a51c54f8ab9bf27abe8c59814bd84136e827e

SHA512
020eed2518781415cacd2297ce746c7b687adb8e364e5a15d7b03322a540f960f72bfc53ca00be81772a9a10e4f093727bb32194da7ce0829500e6ee809535ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCF63.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD197.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit