108d1f1b84bf7f28da3feb3c43da31ea63ef8c9a817697e67c4a7d7668ba2f92

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
20-08-2024 17:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b01a8c3f18a47312aefddc537e883da6_JaffaCakes118.html
Size

7KB
MD5

b01a8c3f18a47312aefddc537e883da6
SHA1

931d327cb1398607250ddb6b5978f80a84dc93b7
SHA256

108d1f1b84bf7f28da3feb3c43da31ea63ef8c9a817697e67c4a7d7668ba2f92
SHA512

996053e0ac953196f333d3e6ebbff6a546809ff6fa7af629e8953144d4c67409de617c0d67e1642d9e2cc4807c08df209dbe247f75d60c18b946fb97841b3513
SSDEEP

96:lqiozQqKud6QGGgGD9YMCCl6oz4IFoSNzJzbMoFdXIIm0gxIsPpweBuTDilYlz5B:E4vMNi+CCLFNVfI0eIsVNkfRwV2Exgf7

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d99090000000002000000000010660000000100002000000048a8aaa56f7115a6c17861d5dcad805ca8bfd23407e5d479865119359cf0d8da000000000e8000000002000020000000204e3b2b38383266dfc535327ee60b62bf1d76754086f772330093d76061034890000000919444bef29704dceb47079503e5451ea643cdb159e6310f9d68e151bf0b342951cf10c096c6958e68ae782d2c8020244ee8923f27a974c5e36b4989f14c8bf874f178428bce73042692925474e2a91fa3c87a53c66cfd20c5110d9fafa76e6469494eec1d62e221cb686a0e6a6c37770c9b37fe9b777cda6cf67b13e487694961f43616674235ec7c94f3ad6daeac234000000097a6837089ee0412c6b4980fa1d8c9f938ba887805ca6fd04bc2c8455fc9fefcd126af3ad6fbfcc476cfc33d84eb054481fc18776d2f60c90cea559c040b3ee8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0c1fb0824f3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000006b46dd2b5b250ead642235dee26bcbbb4e36e8bed3fe082503ff960f9e08b9ba000000000e8000000002000020000000a6b8ac47c5c4338b650270064468c3a1f273a2271900f0f54d1eb63db9de64ee200000000530644197adb866c87695a21eed7ea1b6a4d98103e190160c749ea661867f6040000000641e7de0aa5b40a495910e9502b39d921e63e016ba4580580a3ae3ac1cd35ba066e827d38e0132fd1aa4d2f82081cea24a945b2b40d72e171ebae930d512eca9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{32426FA1-5F17-11EF-BDFF-5E6560CBCC6E} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430335739"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1440	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1440	iexplore.exe
1440	iexplore.exe
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE
1988	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 1988	1440	iexplore.exe	31
PID 1440 wrote to memory of 1988	1440	iexplore.exe	31
PID 1440 wrote to memory of 1988	1440	iexplore.exe	31
PID 1440 wrote to memory of 1988	1440	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b01a8c3f18a47312aefddc537e883da6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1440 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
523ac7d164f973acebf417ff89508885

SHA1
e297342931759e506c7a16d1bd67a1489f68e1ca

SHA256
2314d279b1826b4859896afec2d8bdb3d082b870acbdb626cb17d463fe65c2a1

SHA512
3f5cc684d93516fa985b45371bfcec97856b918876f5d4e728f6edeec64c4e6eaf0044dc1cbe200cbc5997670e3486b6db57668e7818db817fa527fa8ba65550

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
033fa75d46377cc64b01b99e4b8ff37d

SHA1
8c1e7a74112f5b7a7e1fbde81da87fc3a37da7ab

SHA256
22af0b2d2e11186637891d8dd22c9df4410efb15e7db91acba33c3477d3bc245

SHA512
bbe5ab5dfb279ec00b5424d43bc0a3738d7200fa5bcfc39cd395ac8bc1130c3eb885fc593e669e7dca52fa8593026cca606782d768b0d47a3c8f29ce4ce866d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e769d6f7d165e95a5d313ce3a046c61e

SHA1
17fda0479388ba75f0dce73b5b3b2009d8f268ff

SHA256
f92efe8020c735ef9f97c58dd33782b8ff91234a7970d99139b2622385352269

SHA512
ca4e35d44aeb49050b9b681ce1b5f027b6611987107c8786e1f7c9410e3c5e8ab54877c767e793fe2674cd9ab892a6fdc873fd651735d03166745c4a30665da7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d64198fe8a55f46c5470d4bce8bd76f8

SHA1
fe952926a36cfb25472e5786665df77bc353be01

SHA256
031140137a3c589e90423405dae31071c8e887ec65b42052c0db8708c9f9d979

SHA512
bbe33a0ca39ae7ab1bb9537eece7d12587cf1bfd8512629af2e9e5f5ef9ed43f30cc2202254128d581d0e47545f7ebad679070e6ed4c53820ef382399ca29925

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
224d9f99914e349b009603578f9be150

SHA1
a9ab6ce11354f5e8fca114363249bac457653e9a

SHA256
b1ba080ae2d2e9655256870ebeec735c9ac5b4034eca71ce40a5f969cd0c4a81

SHA512
a665f275211481eed1a19606a8117299a11913a56e68aa4d2aea8f4f3b2fd09c01e46061a8903a9e75cce4267525177a3a1219784b64ef0ee74b94c0b15c81a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eff547c76fa3dd6c9b770bbf621b8b20

SHA1
123cae3f0e9a34da8b29c2f47e78dc03c996f25b

SHA256
0bd7d401161b14ca00fdff924dac0933caec7968340250160ae5df64054b97b5

SHA512
fd1cf2c5d7f9ad230af7041f921181d167ceba757c90ed0ae8d4642ed2e78ca946112684444bf27c72260cdf94156c3ed3f43192d7e93d6ac94dc70c5fd65030

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
567650be33a07448d3bba83e2560da1c

SHA1
6567c52de47944780d2bfe4bdb0578310d66320f

SHA256
13fee7cd8a10b3ed3bd359fe010811f68d5e7917d64a054c1c8504bb340ea5c9

SHA512
d393b65577594e24d766387d4aac5a4177e2bc0b8cbf789f481d45354fe878a48e67e1d1240e3c8b02751d68472577be09ea23d1655bf24844e68ced84cd9fbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
69cc364bcbbd4b7ed0b19f03d4856ee5

SHA1
fafb01a74cd6a2cbed70f8d8ab841c15b589e9b5

SHA256
9532f09aad882a04e2f2093f43267a2d0f48b54d06af9b9b794be68cda855dbb

SHA512
18c6bf0f3ca0f9f31253026faee79c13bb071a0122c56f32fa7639586d0680f1a00d2a70a281d50ed44dbb1c1ed7b9df8900dfc3229be9be56cfc278a70f0145

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d41fc4080afe18643c20463bb6c1e73d

SHA1
ae8bddae81f92a4e2e5dead5f2fe5f5bd878f408

SHA256
dd33f7b7c47a7e2f75daad8c74b7a2e597d5ec7cde6153657b9a20da69650563

SHA512
f9c52537a1b1314d940c8290cff25b5914197dd3e6ce0ab558962b6e6ea410055cbba08c32e8d7c002cbc1f6d52fff900e4f7e3bba035aacce58b5c03b5105f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5b0a6d0307479f7d0e2d8ea9bd166b0

SHA1
8966af740561b364ba144b4a432d6342b454cfa5

SHA256
bd7130b8f88b296be8e8d845d1ddf26913cf7e1adf830644b4be8a5483b43ffb

SHA512
267708528472a39c6b9f1ff4f00f19ada48232ab063c2f216f480915a62696954fb774568c2af0eb1d97269055b8e6ff1779f7a1215ae2edc61ac002100258d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
89b4f658e86ec5c55a4c90479158535a

SHA1
50b46d2d0f2f8dadaf9739f409e5d96dbc52a1e9

SHA256
28998e118eb2501876226b364271f888311f2b457dca495f0b11c0ac59a04b3f

SHA512
c7abd53dd8737a73ee799856e296431158ab49837fbb728d86f7216570bccff999874ef5305ffcd3e9b77e06d89541cd805f35653a591a268d9bf89f18efa83a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9a16e02dddbdd9c107acca795d4669cb

SHA1
29d63035138f5d8c231c0b650b8f032305afb053

SHA256
008e90ff098fa62c8649fb6afe16f008af581e42fc4c4bd94c35c190039f3a8a

SHA512
07a0ee2fbc3df345f538cc089b01fb5be66c1a2c366246696c5c6d58920c3856ed5578c5442077904602f3aa2e3f4019d79910e76bc2c147c5e18296e4be5f71

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab580.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar822.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit