0e14ef7b62cb68d9236bd232681996218956239d2e827fc11a3c47f9a6140578

Analysis

max time kernel
136s
max time network
131s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
18-08-2024 23:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a8b932558b4b53f4872a668445f97d8d_JaffaCakes118.html
Size

9KB
MD5

a8b932558b4b53f4872a668445f97d8d
SHA1

46c2ec36eb204b2f59a0eaf459d648a62957f729
SHA256

0e14ef7b62cb68d9236bd232681996218956239d2e827fc11a3c47f9a6140578
SHA512

73479a79c4f2e9be676d39faa777849d15c11a4a0cb92c427c322944e0fad018bb520ae4549414b598bbb08574439184d4f7a1b593fcb1796032fa4f5ddfb3b8
SSDEEP

96:Fyxrsddw5OVc5NddBV6dGu1dUdWdndmMXDt5kOzxsC3TM9LQY50SIqQ1tzKJbfkO:Fyr66QEMX7fxP3TM37Iq0t7YgFol

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd0000000002000000000010660000000100002000000027339f2303ce19759fe5b5cf935e9316e767444c4a36e22702832a2eea8dfadf000000000e8000000002000020000000a54fbfbe69719352193b7231e2982a5aed8fcb4292895fec0319b6c5e8d8a04620000000100e44169c8cc69aff75325d136294b5bd0ceb8725ea0c39fa9f705d194f9524400000003b9a1b91e68d1d17bb52534caa5a3aa41e039645cb962bf0db8594f04cca43c15311c1be4188903d7c6477f7aafc79d5cd4aa493782d8c2ca438cd7e4c7b9a32	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000c26041f96264916039889a087743c5025050854c70654ea2f5c9a97d3b5b781c000000000e800000000200002000000063773e85971b66473a12edecb234082e6212fe04f807ba09980287c9def9aa4890000000e6f6a310b1994d75be73513e46a7c7b80d755688545ec450e3f0341d9f5dfcc0cbf5cc54627c48d4bdcc7c101594990433aa4e0db90042e7821f968c9e3873a8c4aed5e038c1413dd3fceae2854fbebb01784fb5f232437355ecf2f26f87b5259086de3a48809ccb664b3ef8cd8972a0c391fe05a0dec81bab0e7163479ab14de3442e283d9eb2370a0ccf60a94087d2400000004d1193abfe2a53193fc38f02f3f5e17f4226f3c799eee23ee1253ccc861847296cefe4796b6a12221491b4d454d9bb8b6bad432753c01ed2be3b565d0771e452	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430186731"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f08b8a16c9f1da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{415234A1-5DBC-11EF-826E-EEF6AC92610E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2208	iexplore.exe
2208	iexplore.exe
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE
2936	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2936	2208	iexplore.exe	30
PID 2208 wrote to memory of 2936	2208	iexplore.exe	30
PID 2208 wrote to memory of 2936	2208	iexplore.exe	30
PID 2208 wrote to memory of 2936	2208	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\a8b932558b4b53f4872a668445f97d8d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
98982b99053c266b8083096ce7204bba

SHA1
58912f475484cbec76ea6f52ec9655137283cc1f

SHA256
14731f9622ef6860ab01b59e4e642b0b358eb02c4b56b4df1e2eba6468fca6b0

SHA512
23b01d99b1424a4ac1c95e06f7dbbea7e72c872f215d8ab8346b18fc2aa8eed0055a00b3448944010c1733232c79aaf240036475673c9a5a14282a6696bb96ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94e4ed30afe61c27a2fb572eb7a8baec

SHA1
d61077536fcb4bd4f98b0f19dbb43d8a452e9ecb

SHA256
26eeaae192a12fb4724bdb79debcf11cdc5b9d6cb21be956b8240e216252d318

SHA512
5da0a0d15713797c8492f1cbdd2c7628e490b8f7eac51df66fcf2cdac7b24541976e834a1e9feb18b2d6e1b0af3a80a11cdb4ad8262307a2b8d1a2b013438989

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4a1e8fe8fcacdae553416670576f48c

SHA1
3f6a2d19baa2f2ce9e1ad2dfc4f08947a62cee6e

SHA256
ab535281484aeaf3778ed436383070a0c143a7cee0353fa1d03dd6252e8cafd4

SHA512
c9328406af467f20ba58db32de180db4c09eca0e2dce0a96d78d1f99a6aaef4aab6eb6bd4188edddc04d78c57d327205688126d29746784a7b1a28380166f820

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff397f8a156ed0ccc03f33ed6e2676e4

SHA1
10dbce30a3ab84fb545e1e6ac3d24e8831731ebb

SHA256
a7f6edf154e9945d405f253d79c7c107c2708a7573d4697c2c36438104af9c80

SHA512
7bdbc5448b94f94c4bcd31c118e8fb4abb2f501a7e3281b5c8e58af8f2606d5f6af4ea5606176bd4e1fb39068fe7352a057c367f218eb99e2f421cda9c67bdbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc7d441ecc6dcd54cd5d6818fb9b1369

SHA1
0ca57ecebddd8dbc261e4f24298f83b8dc9f271e

SHA256
1cd59db159940ad90c3f58a21231c5f81c06a25a3b5b13a1d14f0bce32ed7416

SHA512
382f907b83612617f2b848f0cbdc49f96187409599e72773cf74abfdf9f56478aec018436f2c5d53a6080836006684a2c03da5b6049b76688fb00124cd72fbb3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82abe6a27a2bd08eeee943a631384678

SHA1
322124e5198c0f103ddd29e3ddfb637f0362cc25

SHA256
33fdae9deb67784bc040a8c034d021fd9a09ed636b2fb2c814299d7f7556b309

SHA512
4c94e2043e21d1a93b4a744a2a4829fb3829232a35753219c294d230437078edf51780746122a181c236220f00239a1e0dcd8aa37ee078430b13637661385e2c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d95033bea985f6b6237cc950f12b6d2

SHA1
070bab591212984d062776659043531e74b7d488

SHA256
7aa4d098f9b1adeeab91c56348095c3d60f51889f487fe78d07f3ee958a6085b

SHA512
ed746a9a4433156925ba56aad8230a3f5b8fca86e7ddc9ce5832342099c95a67277d6b5a8c091cf1c9a4f01c58fa84fb110c6b6e11a9d759e8cfe0c02a1beaa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9B78.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9D01.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit