4690eb6e42f91dc29fc826b62a4421813f77a80fcd8e428f4b3a273cb41a0686

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 17:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

abebc4c8f92899836a3f59a6752afbf6_JaffaCakes118.html
Size

23KB
MD5

abebc4c8f92899836a3f59a6752afbf6
SHA1

432026c41d11817f2718c1ef13f11612921c6eb6
SHA256

4690eb6e42f91dc29fc826b62a4421813f77a80fcd8e428f4b3a273cb41a0686
SHA512

d9247bf706692feb0cdce856d283ab5e6dd4fd80341c2695d508783498dc7263593070c22acf86f0aa83c1143069031d3091f0d8f94b70b9b7bc902843a96272
SSDEEP

384:SDRcX1pyyt7Pbjbfee8479Vup0lq3ez6U4EYDP8ZbF5XGXF6jq:SDRcX1pyyt7PnbfRv79Bnz6uYUGXF6jq

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000993c8d63dcd39853a952d2106305353c2a85cd525fbfa1c13d276abe3643ccc0000000000e8000000002000020000000e8a6e9a2712ea516ae47de9a2c58f8a19259d90cad56d78b5c31e6eb2c811f9c200000000710a1f88b4b4fe9268a35f8d3327f2f0fb10a29346a17bc221edc33ed26749240000000195e230ca397e5560236f56de515bc906b8e82b9069cd1804281094d945fa9d22e39055becb068c637595e47b324e57510c0a3394359bf31c246f2c9f1cf52ec	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430250516"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{BC617951-5E50-11EF-A0C5-EA829B7A1C2A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0cf96955df2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000b56136e7825ae4fecc4aa017eb0ded64f21ffbe225096c60f03176d7d93f9a81000000000e8000000002000020000000cf679b5f1194bf1f436ce6ee1d072103ac362c3a0f5693280f0ba06ecf0617eb9000000007bb1354f933be843c59cec123706597a14eef46b79c0228b9b0c090a6f44161750e4361b3c6ea9ea37ac6538467122c17a1550d458b9d5cc8a490e183cc845248f4139e40fbb6904e431b094e2f9cb1e27a1e99d0f2ccf954310c22568869e80afce226a0fa48ca6a97a61775dde1272b6d834229c15f0e437e9b6ea5b68de62f821aaa509ad020ed0d94e382f1fd7d40000000b4abb020d015879435bb043f1cd5720eb4fc0e349eb7e4967af60fcb7c7e327c2d9d16d6092672680566e81d61a109969931ad789a782b33dae2c8add745d3d1	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2208	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2208	iexplore.exe
2208	iexplore.exe
2396	IEXPLORE.EXE
2396	IEXPLORE.EXE
2396	IEXPLORE.EXE
2396	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2208 wrote to memory of 2396	2208	iexplore.exe	30
PID 2208 wrote to memory of 2396	2208	iexplore.exe	30
PID 2208 wrote to memory of 2396	2208	iexplore.exe	30
PID 2208 wrote to memory of 2396	2208	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\abebc4c8f92899836a3f59a6752afbf6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2208
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2208 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
0e23f65650de2b790749f1fcfeb3cb98

SHA1
63f7f50bef577582cb1a29a33eb3bd34c0dc8c0e

SHA256
082c4b73115ac8d16e891610688483c5e3010ff2ced412720f092783eac7754e

SHA512
908acdacf00c56be46003d48175ed3670ce7e9ef0b664d03098311741e7a2bd99b4464202b10b310dc3e7c539d1c1d2373359254bb5d9c54f5fb12248d3220e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a119ab5ae260dffbf01ccfa323452bd9

SHA1
9bb83baee0a8aa698224874bf54a6aaec5348085

SHA256
7fed023f9cdd6a625e86f36b5075e21408cd3cd738849fe0764428afb209d3b1

SHA512
315ffe7e73087cac60cbed78f869166cbaa924ef0637ec8171db009e03cd748983cfb4073f178a26f4f7d51427820a85347aa5a9e1fa336153b10453226ce34e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86d8c69b2fc177be59d0f3957a32a752

SHA1
4ea95aabdb26a20839ad99318b066b697ce2e152

SHA256
99e61b22a2f43c9a37c2b4bee44a24323f827ffcaa9ea8de2e24874274d38e96

SHA512
a3bd6129ad1d428f41758ade687f81424a8ba4172895e3ccd8b5a0a9bbf17f541ce465f87b67686a2194d0e7dc9eb17c70566529c315f2a5ea8fda455b2f8dbb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f71a9c7f72768c322e54f35511c64e5b

SHA1
40a8504062681645cb500bcf660211d2585cf06a

SHA256
88cbbef55591d304ad3677845d0f28ae92f4057735fd8c4aefcfb34b56f7314c

SHA512
e9666d96607905415ca653091e8c993ce65d1deee00ab47fe0699e138ccc8f6992067c29f61b059e7f4e23c06b0ee2ab4965e5d3827fdcef77211b78ce3425d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e79d6ea292d0d12a8cee0482945799d

SHA1
ad63b5f8a02cd40b04b1aad1e95b7ad22360cf0b

SHA256
871f3dd8af08850908feccaae3984a74631e32911fec074d0e5ca32c79eb7fd7

SHA512
7fa9d59d373226071e0ac496b8e71678c470356e619db6dfd8275956fdf9b3580bbfd520e34b15d71187df5a8e8bf45dc1cd830b41a20afd28fb70bc5c99fbf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d8409ea393f87437c430dc1ae3a0e17

SHA1
8c246ddb679db4151acee25788af6b3d9eb76ace

SHA256
8a577ad7c67aada1e69537c8bcf7878e47fa592419d0de9335e6803a7ecc8a85

SHA512
5bbcc61f37fa05ddd12003bc740e0202a93bee50ed0c5fa571ac967b95a3e318b295eda0220025185b19b9b76dfac682f1bf69242a7b115f9d67f6c1bd6496fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec3e848aefb7f4c7f75630d164f36feb

SHA1
933adbab77f08ba5421834fafc229c626b7bb097

SHA256
8ce764952a61be2b2aeb843adc008156adfaf3104e29cf9519cbe9b115d3f90d

SHA512
631a5ecb4691b68c9949e7d7ef0389e478e202a613058a50b5933954ace1f308666fb1cc8e4e3f66b026b499e6bf46161c89cd52b261e8b89ec959dcbf09b2aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
d37660cd841e67a5f1cad909d54b7d67

SHA1
eb9668d00c016a30c1be02a4734a50d04357f387

SHA256
ee903bdeb01ec2b5dd65241b0a473c66e73228b87c9d9868dcc84e0bec36fea0

SHA512
bf423e5d38fff44bb8304eaebc0da476e236083b8ff613e1504482aca0ec4224486f264582445c8e4c42640b98a303c2235c77270b340bc0960e853f07b01473

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEA13.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEA35.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit