d0e3707359e72f0ed8e0a221174e8a96764e06324781337c9181d7d1793e6e42

Analysis

max time kernel
121s
max time network
129s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12/08/2024, 12:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8eb3af3b9128f8e7c80cc2f3b626fc96_JaffaCakes118.html
Size

6KB
MD5

8eb3af3b9128f8e7c80cc2f3b626fc96
SHA1

a0236378546ec4cb787759bde9c4fb971569c61a
SHA256

d0e3707359e72f0ed8e0a221174e8a96764e06324781337c9181d7d1793e6e42
SHA512

809a8578bec67e191cb7421bff11acf6ead4b4d88be444dd349fbae199defb944968edee916c6e96471177b896499e560db614c79a7f4481158a92df8f56f647
SSDEEP

96:uzVs+ux7zjLLY1k9o84d12ef7CSTURLcEZ7ru7f:csz7zjAYS/Sb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e03dd820b1ecda01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429626682"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000ade3c0985cc264fd84588c23088c142809ef3be2c59bdb350b63ff4e237d2477000000000e8000000002000020000000d5984adec11875a93ef41bce2a4f0302bfa0727263b0c5c060ae2f50a9874834200000000db5d57c6a6a14a28b92b10ce388acedd71119581dee3ab9d56f7663485f7403400000002d8569fd6bcc5fb3d6f0b3b4a75e9cc1ba236f3d75c45e7f620d7d50553b1008ecb79788c9c0d878d9264072a5d4c155c8a8eeae1384349fed5872016f1c0ccc	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d99090000000002000000000010660000000100002000000052ee36010ff112bab11dace60ab2fa793abdb5f1f70cdc0361cfc9d88f3302db000000000e8000000002000020000000fcb4cbd266b1917f94197897dfe85f859fc85335f5143b4c0f23bc1f1535ff89900000003f6f6e960ae8f9876b18521941669785ef07b72ebe89fac372bc84f9616366a5b2ea47fa23776504ebce6ae12fc882d5816bd86de39841837d37f4f1a1aae54440849f734ced6d4663d5f3f30c548a46b5e8758e265b73963f904ec15db649e0519f4a607bc3aa8781f5221330a0a055b4ec41ca87d81456812dcacb0118d6f31dc2f04dc6ac2b06fe2603856b26ed4c40000000ab2b286430854506ca36f0625a13a34ad75f80f5efd1ea1dba924df5225abb2efdd573cfa0d22432771f38aaa01f16d659eb7913a88c3d021bb3cf1d9d2c37bb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4BEAD241-58A4-11EF-B552-FA51B03C324C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2368	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2368	iexplore.exe
2368	iexplore.exe
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE
2796	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2796	2368	iexplore.exe	30
PID 2368 wrote to memory of 2796	2368	iexplore.exe	30
PID 2368 wrote to memory of 2796	2368	iexplore.exe	30
PID 2368 wrote to memory of 2796	2368	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8eb3af3b9128f8e7c80cc2f3b626fc96_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2368 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4e74683ef03cf2315255a295ef727da

SHA1
d51d93607a907933f31c4e91390c5d06dff9bfbe

SHA256
3cd2e0e1b3a1c5767cfed5df8ae2bc3c4aae74443959c9f494eb77e558765eff

SHA512
86a4b96a1f1276cfd9f24a4bf3c5381b67dee6e2dcd6f0cc4b863d1fa3c8d4b35cc3cdc0e03446d5aff0ceeb2ed58c4228d877206c57bf8bdfc4a2e295b3fc30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8521f7303bd28f3d2dadb049ab4781b1

SHA1
bbdc0eef827ff4d33882d50da167b6fa6ae20412

SHA256
8ac3ca043e7874d17fb795e72ca1e7546a23fcfb416ef4b3af1853c84e3c5a15

SHA512
4b163d0fa263b9d6c6d281fc396a12ca080dae25d920b9864facf245a283077ba369f6f84c10bf898c984ada2f658cf1ad55b24b2f6e7d0b0f33d3433881aa5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f73731573ad1b0d3e78d56b492aa671

SHA1
83837018e70a56a7f33190174719c2d8d27348fd

SHA256
0ff8065c2e31d1e920532dece4a1847c77cc861d1ad9a595cb5306720310a070

SHA512
66663f3cbe6f3eeb0df46244f7310a524616284d4cd403de1c208b13c07737e0042bd8700b3e38e4c62b124c052a57696dd645bf720d76725359de09f2f202a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dad591c7b478399b08599e05d88c3d19

SHA1
9d5e3d6a0d0b9345650c7f072f497883daabfdd1

SHA256
8e643ad9abe6aed4cebf91f64506a8b833a4e1c245cb61a5ff4504729eb7972e

SHA512
6267d726bf907f654d9b7e210bcc82470965129a594c5b2a1bde7254c0c9de9c7a510c35f283ba48a19e7c8d0f29cb61f8657486f704ebed04381838bab35b0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
919efc64f4112e9fc4ab6ab507750bd4

SHA1
45aca8c0ec5a6c08aebbd4ff63fa52c56c0b26f2

SHA256
8f7b210241c1dd7b06181566d3197fd1f7780f85e6467f50a5d4a01e4a2acd0d

SHA512
9af1161c90701d9713d1bea17cad114c738ab9845ff24c6be3a67dab29b76b4315af3942b14198d4a0f7ad73593627be24a99a1c8c4bf2967f81f90449c98077

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef5de07ea45dbe163725a0799aaa649e

SHA1
ecff8bfbedcab15aa822cf9c8bc4a0d6b7acd228

SHA256
aeb59388af91f4c524b6498ed7dfbc381c171f15245b47ec3deca308941ef6b9

SHA512
d94665b19de8933ae3694c274bc00061a5da854e34275d422252267d551584d163e50d593e35578ceedb5d01cac6b7202e8fc5089ff4db2fe9da5673922e80f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1f923537f109d9abb9b741e32e9b931c

SHA1
53aea09605f381cdc8db437b3c3dd6e7f8e680bc

SHA256
24795ed32abe4453ef647013366ae71eb4c890cd8e7cb61bef14d3c8f21c351e

SHA512
cc5b3d59aa8fde0f0d0a389258c66bb1b7db8f65d668a8c5b5d287e340842547ebb0a2e404dbc344114fbb5ced926998283849252021d6cbf83dd3144c380bd6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ed381c8107426dd51ffc418f10290f0

SHA1
d3e6e6b05d58d68235eca467889b0840d6790ae5

SHA256
cc577bbc6033b354a69f0a9e85d623eef297351ba8c020d2971235e233f6e8c6

SHA512
c35a394c2f8eb3b687062d8410332cc8e590dda8535b64a2228cdbaa2bc75af4f58ad5a403f53c198cf386279899e92b6a948f325dd7c37af929eb092506a714

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3dfa50b91f6b35db20ea2972ff069aa2

SHA1
3c74430ea70055d3a4c6bf8c21e4a3b61fa29b44

SHA256
7ea08c607eaf701c474d9bcc4fcd4caec836647efaf6196e960eaa42b0f9b667

SHA512
b0ca85a795d6f117614d1c1f6a42935243ddab259bf46fd97fb3d661d39de8148f47529b9f5962c1147b3d0cb3b66d948e6265103f77f45dfa4b9a45eddef889

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ceb2b245a2f25705138e9602a3a982f

SHA1
3d95cefcc2c81678282e26f2d0ee369c424b3d85

SHA256
65cda21ee210b1c3631df834d2a9fc43f339fb8fa05f6226b1d564c321cf1031

SHA512
2d677b67225c62db6bb2b3f1af1b037ff03c34ad3d3e902e75f163667cbe2a6cc11669cf39d8729513ac738a32a075c08a50470914c501468d8666d1c58ef371

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7602f350b68b7def540435f57c592767

SHA1
6936ccfecedbee082b325aae881b4aecad71de38

SHA256
7a4f6122fefd1bd44f2466da9c7d47381a0330955f7e2b4904fd133705217ac7

SHA512
4ccdaec1aa2a2c04de8131726686049d852327836f40eb8b6df0b9921c47cf0240c75f496ca32c1154d6e059b33e1b3b9b173367982f98e7cb12f6848d3e9cd4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5D9E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5E0E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit