2d1aaf494f59da8f107186ed7bb444231d34b2370f81757cb2671e843a0e43c7

Analysis

max time kernel
134s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
12-08-2024 13:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8eebd119778b077e3649c47a8678d74b_JaffaCakes118.html
Size

14KB
MD5

8eebd119778b077e3649c47a8678d74b
SHA1

0a066e7f4693a29e15a44a4f6cd29b0126aae51e
SHA256

2d1aaf494f59da8f107186ed7bb444231d34b2370f81757cb2671e843a0e43c7
SHA512

95043bd10e54d4d72758d2d8f6c20c83d53fd24a1d7dcd0fbb0be2ff1a880c715392408f0fd115e693522c2acc3c2a6aef5c09901790d8a53ad39d134c370063
SSDEEP

384:4hcZdzQsce36QZYOcH/haXlyryI8YueHR:KcZdMs/KQZYOGaXEuI8YuU

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000edce0b1fb02458864dd435c614c7e160071c7e2b502321259894c5ceaeff414d000000000e8000000002000020000000cf4866125879c74a22109820f06e4b08dc89c7b6bddc9f22b458afca1814e7bc20000000c91a80e28ec2aff36140e94b6373b12a9bd1f1df5667e1fa990ab7be675c8fff4000000005ecc665caf6f685049dfc6fb3ee6dae95af5e7fe56b85bfea966aba4ab4535767420ea7d0c347c4f99e08e759c2bf9e8f746ab8cd0229a4fa713f99b18aa579	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000628193db0ae8d214929297537a8a589255279cfadf5dc950bac771c67a1fa8dc000000000e8000000002000020000000f244e89751e5afac7e357ffa3030e7cbd472f109cc46764e24cd5348e2ae86819000000039475fada3fcdf6282908444947e2eed6a0c891c70b81347670ac4daab91011836e9b1d33c29f84b4c9f1c08e65c44fe16673e0742a9fb7b39ff183e0de8e20be63538a1c8dae7b211b51d63e0ccb9b04c7dd822865f5ba89960908cffc4b02ca0b989d1298cd2c8137ad86090ef46467516be34d3b957b12adbec02219f8bd3c85ac422b3faeac998f9073bac1eeeb8400000005ce95eaeae3a0d3a60dad5563a840b9f71611401458ac7a10149ca478c02c4f0780b0f70bd26fb912a51c83b06fcd9aecadf977909cab00101da2bab0c0bdd12	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{94EE48E1-58AF-11EF-8FDE-E2BC28E7E786} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 408d8969bcecda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429631529"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1744	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1744	iexplore.exe
1744	iexplore.exe
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE
2468	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 2468	1744	iexplore.exe	31
PID 1744 wrote to memory of 2468	1744	iexplore.exe	31
PID 1744 wrote to memory of 2468	1744	iexplore.exe	31
PID 1744 wrote to memory of 2468	1744	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8eebd119778b077e3649c47a8678d74b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1744 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5c362ca92107ccb2a21750f0412f82fc

SHA1
dbe8528ea827fa69951ab5cac813323b85e94f0b

SHA256
c66be09ed2e3686fa4c3ba01451071c12cd3780c48422898c8df74664eb80a5e

SHA512
32f3654de90587187bef1dcf1b39d1609708db6c82ff80cdb0691337ef40e062e47c88dd550a6f00f05a596190bc0a55840f9906400553e1d3bc877634988de9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73946bffd0d82b4869889f4ed4be1b74

SHA1
a4084118e5cfd2c99e6b4d92e0dce4f47f1b693a

SHA256
7f6d87f3522109ab398cc90b0bece29557eba73e589f9944f8ba8a1d1b3240d5

SHA512
8bca8b9da347b846ecb24e661b7dc119612744d48d000694260fbbca3f2af3b82c6574734f1e3370b41427176d6247f71cf33efa52b52eebdfb391af35b0bc01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98cc7efde9a076fb119c2e7372476a65

SHA1
490dfbc531b50cdcf385c67356e3568fa95408bd

SHA256
b9d58f9d951bc79ca03446d8bb2f6fffc7faa857c47cb26d708618101da169ce

SHA512
53b9da4c7b2b41927e18e13fb53a439329f2f2006ae68ad0963fc4f051a350eb4972466949b3ba553a2ad7fec3b06af49d34f8e490a54513209e76df1c6928ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ea1468927c1261756c69f68c09dffd62

SHA1
de532a51ea1b2ddf59d9e4053f05fcd478ed258d

SHA256
c2ec393d7561e60b45219c915e4e31cbbf7e79cc5d35612191de3d3d1391429e

SHA512
3b116c6056960bd234f92de991285bda0dcd26cfdc2eec7d375c1ca5065dbfef0a316e4246cf1621fc6fbfd2b39887c5457d9cb0199cb1b5d1b6618dcb94bcad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4609f7f817f90cf793694deeb3e3903d

SHA1
bd4fe840126d4927d38ceb92c342293bc7096a63

SHA256
5925b76daa89ffda3bbd2e33356b1c38cac3cd5a22d6872cfc11a0630fe93b82

SHA512
28e3221ee5db44bbaf3bfc57cd30bb9ede2c1080085603b4fca4f60937e035b1d6b0e3fb6a6ae98d85370dcf4b4f4660b0348a8f2b2e2ed49d6d735336c56842

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc7f2d971b97cb8ea4d8decba3669e93

SHA1
69e2d42774c17e555fddc8598c2948fbc0a52640

SHA256
f2125a785c44eaaeab5eca24cc7b87fc27f6f2010e6c8312e21bd9e9691effa2

SHA512
0c3ef14a792cf1be05c9447d5580d529be5fff7bf799b3d977bbe412497701bfdd447e3e25a532eecba9f8c78356f861148d1c212eb7104123c3f5afab0e7f6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3fee09e17bd92569ab6da9e039f3da7

SHA1
9b4229370ba40a63a239b7ee4dcf61b765229796

SHA256
4c40f25476c06563f27fdb01071a324e549df566df7dc0233dfbd45e9d89df19

SHA512
c9585dd6689dbe7aa44c006198a8513bf5200577d1f05974c5bfdbf48db9fecdd57bedef1f8f6474fcaff27df28fc8e9a84bff8343640d77b625718c99d0c7f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06947684f2d349e605c330df6d82eabb

SHA1
9c1cd963d1b95aa9125be430e9025991712c5097

SHA256
80a9b5801d51f4441986ee173605d2fe161c5fc6c0ba52d6b3ef8edfb7f29f59

SHA512
66ac9352a608a2602e805c87d76b77ca35e7b5d0cfd204584eaaf8a2f57cb74d5bba3f8dd0373e4e05209dfa9cb6882df0153891d3794eef86b8e8b28e7140a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de3956e857cbd009aad4246942e536f8

SHA1
602e42e695cf89821aca9f8728888f041b9b0e0c

SHA256
6e62c303b25822c6fdf9afcb8d334e56b14629737ffcbf58426171324aa86f07

SHA512
8593c85e563ea8bfe4bf89fc3ab344e00841da6a78bdbca59dbabad9e2f7eb4f773a591dec2106d149e4e5a3228ee3a9afd33a8a0d2dcc6d3e001f6cba268fdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92af834716253b9246bcf5c6590d0582

SHA1
3be21e90a408a34331f052ec89af52dc3ab639d6

SHA256
809a1b68b058064c25e4709b75c62fbd64b33b91e234413e678c7d75720efe13

SHA512
020aff921d613a5c8e2e17dd751bdeb0e1ca8faec43575dbbfa79cc9a14b325866bd3d6e6898a03292e9256cfb518cfae11e9a399923a845ad06e195b76eb3ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6e9da3d4fbe665f5a1f0a93ee0a96a6c

SHA1
35449a6e1be34c4e2075c9ff1231c7b471bb6c05

SHA256
4c289101979ae6b89dd70e4903df07929799324fad9025407e49016285d3caa1

SHA512
c1fb3cc775b83839d38e59026cd6ed6f47d05d973ce24cd979788527061534edf0e4e9f5934ca0e3fbe9ff0c0bbcb4cf78f0e64914cca4250f7b23a8687ad88f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49b3a0d2a757fdfb0f38962c28a8a6f0

SHA1
96c651e8b54b246303209cf180c0c9b03d573108

SHA256
a639d56f75a4cb01d6df3842a652aab23853746f6de86341fc3d979c5bfc062e

SHA512
441c9f7182deeae413cc7e6a483cf358797185f161c547d04e41bfd5a9c0d16cc22cf6d7ddd220be25eb96113a476eb1f2a63504a1d377b0a2ca48b64a9e8946

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a03f2d54ab5864187f63df6d5e15105f

SHA1
9a6ae2e3533ff050e4f5557313a4cce900bf4846

SHA256
81aeae864c73f95e43a6254237cf859f36b0dbf7f418456b8c2a18f56903a6b2

SHA512
23a0389018fb88136163536db5b2f3eccf73aae25efceea363e9159e51b5d1ee03b420b39d5532608f4eb25d2da9b830443fca8048cb91567b4e95fecf349c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6441ff540bc4f192b8de21585b98d12c

SHA1
bbadbc9aee5a85610a21c08efb06ed8189195b2a

SHA256
c34e435a0fccc7f5e757300b4db3e425bacb59cc8c11d76747be8fff874a7767

SHA512
e35a8187d949079bdb4a7ed175357abb9d319cbef89de84931eee0df57843c1c4f183049176d891fb9c2ffd8d2085328b69dd085d7c013a68678dfec0388b90b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
131e394006863dbe4769a0f9eaacd028

SHA1
9c8ef866bf8523a564959322608a9bba65c245a3

SHA256
673a88afc221f214dc448d3b787e1329cf4439e2f489adcaaf19aa72722e9ffa

SHA512
548aafb7bb8683a618b31b6df55bf602ee3c6af148a86f7122319a548b9cc701c5fe8b35ad0055ec99a04238e2dec3126417450f8f6e587d26c236900d52a9a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF6D0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF750.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit