583cf4c36679f99896b7a22241bc1dab80aa56a41feac08b78349ac60f1f0881

Analysis

max time kernel
121s
max time network
134s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
12/08/2024, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8ebef8d1f6795493d8d8931b64b9a08a_JaffaCakes118.html
Size

9KB
MD5

8ebef8d1f6795493d8d8931b64b9a08a
SHA1

e4ed0a379644f000b567c083ddee861d52e59039
SHA256

583cf4c36679f99896b7a22241bc1dab80aa56a41feac08b78349ac60f1f0881
SHA512

b42ed53ba7348c0d45a5b1676f49544ec42a10cc0bda9f21cea5ea1345ab3413cf7e21942d9567a50b6571c45d42009d6430585d152a35a15880543f22eff9d0
SSDEEP

96:uzVs+ux7PQfLLY1k9o84d12ef7CSTUAGT/kPsdpUlVHcEZ7ru7f:csz7P4AYS/BmUPHb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429627544"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d99090000000002000000000010660000000100002000000077d4b92d7ec382bf5fd4152e087006094012761e735304dce3699e3b40781aef000000000e800000000200002000000049e8b9312f639634aaae27ab2e3e5ac4bb1b8e4e2d98d74b09811b694f3d1a1c2000000090263d1c3940affabc3ffd201caff674c31fc3eb34cfc2dfea0b2bb2984c2ed8400000008ec851e431cb41a68574b01a07845e43463690eb9adf459289b71105d30a89b672e1cad660eba00f6ce9a9c3c77886481a1da9e2ddc6941a286d3a2c465e87a7	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c071a420b3ecda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d99090000000002000000000010660000000100002000000052f764b54ee93bce39e6e7c689fb1109200f2c4bf7d2b7e5c178fee7c2a78c41000000000e800000000200002000000048d348427a2d31c998039968fc94c99accac82963e217b17b39dd8282eb63d3e90000000b1ac29d1d8f6c304e7e57fcbb63ed9bb9619e95483dfd6452ee7af680e254a76350990f9fff4964a7642af97fb4ba46817f9ed481a103f3c3c8fbe730338ec40474614fb7d0829163b898a015835d945ed6ea90dac5f59a8124e78517ba8fc906c6709fc8375a29768be0336d1d895cab88179c0d1b364c5020e8351a25f84c212f6dbb8a7ffdcffc363a11e032e2f3340000000ec746da988c4683125464080e7957d64cc648795f6495a429ede19d19b31130acfbc68bbe31d72e1c915b207cf2fe206d9ae1548db1e2d35bd961bf8f61daece	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4A1F2041-58A6-11EF-BC5F-FE3EAF6E2A14} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1956	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1956	iexplore.exe
1956	iexplore.exe
316	IEXPLORE.EXE
316	IEXPLORE.EXE
316	IEXPLORE.EXE
316	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 316	1956	iexplore.exe	31
PID 1956 wrote to memory of 316	1956	iexplore.exe	31
PID 1956 wrote to memory of 316	1956	iexplore.exe	31
PID 1956 wrote to memory of 316	1956	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8ebef8d1f6795493d8d8931b64b9a08a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1956 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:316

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c7823e50a57b478e6b4183bca023760

SHA1
87b597a74d1282131147d54c8514e79c92c8fdd4

SHA256
8312826d9a2979cb04b7e3d65cf1211096e4155a1e335f418fa376e03cfa2205

SHA512
6658196ca51575177e23831c36237f821ab6547c46e1cf731fc0533ff3fb7094ea93b8febc275705691fa20c1c300f0f1a77fec359fb13e8d5a3e4e0a48d91aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b7993bde9b88b08c8aa440b3bcce9d40

SHA1
3accf42ba8c35f821b5ef50f54738eb6115f406a

SHA256
94dd44348cee77901f0ca0a2af1a62b2742d0ff453bc65de9d991183eb5198f2

SHA512
2ec1d76fdf3a1e1d7769ff733f4143add504f8fb7f194f8174082014cb6a617fc660f591cd298d1cb93b233c3c33e6244e6d592b9e8298eae0c6fa6256ddf908

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17556723d4bc6c44e20efff88fa9323c

SHA1
0e876580f8342c35a3fda0208653ce0e5c38a0b6

SHA256
fa678a1b27bf2d0077bf2e9c84ac74fcedaaf3b729981f43f5e9101ff3b1323b

SHA512
b671b2116ab11e3c4bf6c88cb2b374d5844c7c874a6676f5d27a0b50acecf88e3fb5835b2bde7044510ec439b14d8305d9096e148d204a0daac76492b9014109

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
192822dc122e63e7d29bcc72404c4b81

SHA1
8b68b58d3f003288e7b3237b5350d13985a9e9d2

SHA256
2bd08da6ccc21f53a4eafc15891a6b5bbffcf98153d6b82b466879c6c7b8251f

SHA512
1e8d4c94206ef38499e40aec24cab2e24b8299fd7d7c189a8430283e12f1f0d6076e383d950ea9b107b48c8755a0a9686b315c1d2d771142d549a7da9368998e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04a1400cbc64a1d4dafae902fbe288b8

SHA1
83e88e49349dee6daaa4055942a9802cdc1578ae

SHA256
11316b099818b030f4faa627ad5fe6fe67cd701a3d6d7384491a248d059d1b54

SHA512
5d6e5ca6bba9f6df8f7eb6d8e4492a49891dde253837d678b8a3a6c75b25d7d2c4faa3f29401a6ad2dd14e04a7435394aa7ff608fc79a5327c733c8c71b34b06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d560f7f565bdd11c62d7f0d179ffcae

SHA1
9fefe38c160614b3c2c2578b16b92bdfc798e762

SHA256
b67799bb2a472a5c251b91ca306a8b19d29ab5abbb8c2a03c192046dfa56cdf8

SHA512
c81533558cdf30c5b783fd626bd5bdf6a711c50cb0e546b6fc36fd55112a8350078c7a19b2fa2fd6fb395fe26754b7bd7a592754eb5c31edc3141e66cc243579

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
561ed1988a6fd3e2f62a32cc1bbf690b

SHA1
159f0296d5bf5df3d5f5511ebd1b9a762a9c8075

SHA256
58518601368e0e577fe1e510c53c7a9a67e66c70508da51c0602e16d49079d2f

SHA512
2aef108c15eecfe48a67abd7096ef8a53396592e94ddc0f0d0f27bb121afb6d4c1b2c90e049a207c4dfb0e36c6e844e09bc6c0fd1d4119fea0f28a13c44df2de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0033eab634f37423c7ddbba0f1d52530

SHA1
a70839a76cd97dbeecad628f04a0634441b9a19e

SHA256
6a8e54f50d05f0e6901e9729f44ec7e64bbbe1fe2f569cb6700dae680b1390de

SHA512
066260b25490a9490b49d338753720ef985405393007543f113638053ccbf854845dedc479001a3a0352156920b848a7b8c653585a8497da0a8d8b063e517e53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74a8e877846eaa20a92a8e64f8dc56f4

SHA1
e0fb465371d55383e0671d2169626d568f8c5cd0

SHA256
ab59b642466019b52079de3d84a4b9f81c646f76d308fb645ede63643649eab5

SHA512
33d34e87043df3edd48cef37e23d9290407dc603cb914add492bfceaebe7bab739fe62d5e94ccbf6cdde1775b7c8dc2bc6db9a669d698fe95c6b77c6f4ed3bbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
606a3e2f3e5e196e1653a4589640fb75

SHA1
f8fb89bdc8c4d429b4d9badc63e6715062a158b8

SHA256
8de854c548fa132b10e8758b756edb9a8777dd8682270e309fecca5bd8a9a327

SHA512
b19c2d8def7df18804480ff5af3349cab330abb4514b0765bfbe021053c4a3a19f19a8f8ae9865c304db06757d7814242fdd1887f9e4bcb6291ed8d6a57e5c09

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94151fc963bc7399da839d8d36d59a40

SHA1
bca688646bd9c9a8ed1434099c3acc59f374325a

SHA256
dd38f4fd910638252227a803ebee9b4b580cd6902b97204d3918d2960ec8ae87

SHA512
0c4fd3173f9d05760d6860758da791a6bc8483eb2599d2ea4ccce2f3e177f1e3575b69b1f13d92d6b45ef7f5bf9ef40ede3131a1c631e7ccf528849682b14e7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2D0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar351.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit