f71b0597450cff6f134e7b6019612b1e02b40f0dc8210e958afbc321577d0659

Analysis

max time kernel
139s
max time network
133s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
12/08/2024, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8eb83adf89f618ae5a8604a0f0e1f178_JaffaCakes118.html
Size

5KB
MD5

8eb83adf89f618ae5a8604a0f0e1f178
SHA1

250d38e66060212b88cea5fe296fbecb2cb6ed01
SHA256

f71b0597450cff6f134e7b6019612b1e02b40f0dc8210e958afbc321577d0659
SHA512

056cbf5239c87709731d95cdf77e00e8a372a656b25c02e5a236f2edb0e8132f9b10d7d7702a4998af407f7c33f972043d1823486f8548c084c123659a74a96c
SSDEEP

96:M63URAfmMA/5NaiT0sOLsQOtMOaaL0nHP9h32VW3DRbA4CExT4bH:MkUb/5NxyLsZtp70nrmVslU4Cq4T

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000655ac3e404ad800420659fbcb48f73f70e6dad01cb36561f81b871fb217ae32f000000000e800000000200002000000058e262d60bff6212cb350b66bc071793d785b86484f49c2bde9a1f515f67cd949000000059158a2624ab2154b24edf0014c35dca10e400c139839a481250ac7f32779af199fa6e8d07e4b90460ad232515665ec23c8be3d36394d51d16720e7c2230d1d590c993df80dcf15e9699f6ea9a46b27680685c2e99f456a0f8504a0c3e4f78030d7d84def5969901d9751ce9ea7e72d0a7b8607d5e7ec87d0e215996408b332e15bc66deea1e247108952b0d8dc2bb9d40000000e4b1f9c9baae7f6f5411cb21214fcf214b477a5c2db11c0803894511b90f2041cefb8fb4bab2fe3f5be41bfad6ee48eaab80c2b9bf8cba65c955b299d5bcc889	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429627030"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{17C4E311-58A5-11EF-9816-E6BB832D1259} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000b7b7ceafab632b58b47c4d1dc66b96ffb1544f0678a5544f14131d8862d2bffb000000000e80000000020000200000009d202fae66811b677b3a68679686c17c38638e428dc3d6df42a9b63bf38ef037200000009de91322b5aa8a21ff5b6824d17cf2bf63b6b77c5e3a7143ac97c8714ee6e4cf4000000091a98471208164e38d129e025479b6c003b1a44f52f948419f24af1a63f4623729d3d60a84932e4b94baf7b53689d8fc4fed007c26d17fbd34685d4e089ed0c0	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0b95eefb1ecda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2896	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2896	iexplore.exe
2896	iexplore.exe
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE
2736	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 2736	2896	iexplore.exe	30
PID 2896 wrote to memory of 2736	2896	iexplore.exe	30
PID 2896 wrote to memory of 2736	2896	iexplore.exe	30
PID 2896 wrote to memory of 2736	2896	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8eb83adf89f618ae5a8604a0f0e1f178_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2896 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29316e7bc30d3a643cf5b5fbec628055

SHA1
f0b186fb22a50d88b285f44d203cf9d9b6b4bc8f

SHA256
576a8384e53e12484e3c893e2d52ccfa14bd8d442ab71627d07337daa39929b0

SHA512
c154a3410ecb45b154240c679962b43f817e9bc8306812852ffc6648b16b30ed5d6ce8cd25001298cb807f7b2ffcfa8f451166b16e4719beb9c91c0d33b01415

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05a4bcf762c8102987df6e2d05d11399

SHA1
7a830905e27fae5f7ac628447b2ee91375885634

SHA256
b82162df33c34a106a8f12f77d070d2510d96c9ae4f82ac67a11df46b978d2b0

SHA512
8d3932c6f06bcb402671997739f557945810ca0fb09329350173eb8c07f1ddadf651a8cebf0ad28dae56696afcbf41ae1ce8170ddb8700acff7e1220a5494535

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
380e98e55c3ebe239415f85484437bc3

SHA1
48e45504c3d8b88d24653ada839004dc3f3c7a63

SHA256
4524b9166dc2fdc4c2378c372783a5aaf52a3788896b2356e343b14cb956420a

SHA512
9271047c3fa2bf2bf694d6ff6af16aa0ae8aeef8e3690fe2c503a95802610fd14e32293800421e87c539c375ae99fe5b9dd3dbb0419e326d1e186b295b05afa3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7be70b21491129727b7727340c9ed69f

SHA1
7d6dd6e57b2a890ddd49a3ac9070a4729e5660f4

SHA256
a3699bee38d4d218507ebefe1f3351da9477a3ad8f318d3cf2946ff5a3d9dfc4

SHA512
dbed57fce2154af1d50dfc4fd3248cbf36820ef8c1ee8e801f8bb839bc34fbb1b00417cab751940bc08557f07fea31797ce20ba659ae72361f46c82c72692682

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d23cacd1aff49cea374d749b9311fedc

SHA1
5e61725e4ec4d832536ed4e59b305bb1f76dac43

SHA256
b759afddd633eddc6bd88a9c4b4f1910365548a2e86595a9410be94c49a957fa

SHA512
a5111266a4e7609e735ca99a942502781f6ae5ce67ff9cd22a7751621d9dc531741149ecbf69f66607d061e730275e0b5f242e52fbfc2bcbf198394f49174d5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a394ca4a547f4b4972702e1aec00a8a7

SHA1
df3f68df97d896af4a9d7dbc56806a566d0660c4

SHA256
67f78beb669159513321eba5a87b1b04f920f82e9ddbad1ba5efee9ca5a03d77

SHA512
880c1c6265d8c6087d3e93f87a3fa28da6df038f0f00119e155784ec3def702f7c0db78bc7bb7a8cc80298fc937f6de290ebcc12bb9b0df5821e285e97fd007b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
41e1902c9cc89998db48b2e7bfeeff7d

SHA1
834ec2a1b80605ca52bb48c338e835746404b5ee

SHA256
e8b65cda52dc2b13fb1aa9cbe3e5296208c0fcd10e4d3222b882801b612aedf4

SHA512
e589fd59b870c12d8db0ec3cf0212b9faea7da4f8771bf5e5f827ebcee4f104a320cc0bd77e288926833c4dcd8b9b0214c6018d7bad1ed12d6506f3c989b27e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73ad3f1d2e37b4a37b29eafea8c8db24

SHA1
a01d5a5a5013b12934a52196c7d0af5308743daa

SHA256
cbbbe53c7db69fe9523fa46f4fb9fd4ef6d4a09c2fc464e500fa083f4313b411

SHA512
c5a3e55625945223e310bb291d969aa7d4fabf9392855e69bbbb5e205d01a3264b9a93fe032e75534010753817e477c7717b5c87a9510a2942d48f9f27d7a159

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe465eaddfb457ac0dfbcf66a104370b

SHA1
1e2955110c946145b559eb293c7241e706781a3c

SHA256
928558b8ad8447e55bb964d6c433e89097433c332f80deef865ad9c3c14d0be1

SHA512
9abff2778b8fbdfde4c13c77c0cef31d2301e4eddd929f45524d55126bf626b31695be6b4b7ad3140c51d9486cf83479348cdefe561e530b6678af502c1001f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD03C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFF6B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit