f8f1050e17249e31ac3df6c44242b480576aef7cd076d0daf0c6681780ea9829

Analysis

max time kernel
122s
max time network
130s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 18:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4a078cea1bc784c6ca5242fc37705f8_JaffaCakes118.html
Size

18KB
MD5

b4a078cea1bc784c6ca5242fc37705f8
SHA1

7e92c5685a99ef2b003b8f5bf6d1b86de2d10e8a
SHA256

f8f1050e17249e31ac3df6c44242b480576aef7cd076d0daf0c6681780ea9829
SHA512

f0301f3fd308cfbb7c05671328c33d20219a2e94dcaa8a3394002c2535f6625bf5aacba74bf1a37d24c6d14d6a49013c2916e9544779cc14a1337e35b53e6c96
SSDEEP

384:FGWgeHq7qxcF91h76UHmV/MHPEzBAUmDkBgIrGiBSrn7rT7NalbozeFgfLP636t5:wiKL6UqKs1w7H7N76FgGJyQw3

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8FF02D41-5FEE-11EF-91DA-667598992E52} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000003cdecf482577645867e1411cacabe997e63c22beeb87c6f27446a72518e4c94e000000000e8000000002000020000000ccce48727f6618b975c285af2ba9b07c3fcccc38ebe198ab76920078723cafab2000000033b811b29a3e3c7774e450d0babf814e04a84994732558eed0e6511222f4bac34000000094aa147ead0c627c724699f243364d33dcc0d47347e05debbb40e18bc905993857a43e20f31e549ff022c4fb065b2c266b069b51f7ce7a778c8ac0c00072f28b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90c01866fbf3da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430428239"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000000f260e7a68f45e0c8bdf836b615b958ae8026df9c887bc8564bf74aabf82ae1d000000000e8000000002000020000000c29c48f72a6427a7b5b4b91015a945721733d52e048871add90461591cdafe149000000005926fa452d95979fed6ab1078c25f9e529699b800f3c39b467ea154aea0280bb97c2904f3b6f237f8161c9f860db3369329cdea9b74557e152c805f6feccc6ad62b763c7d665ea961c94dd3ed0cff7c649311c24b5d22177110e7d157fe3ba2774a46083bcc092f08fadd9f19436a983e691582e6d57848fb577a36b4db86bc4357c409c9d3654808c9af5af16fa35740000000880cc4e43c509393555448fa0eba07228aa41cbd6a8a111b14feffef4db5a2018bdf28cd42a61ab808dad1c6dcbf415acbf8c6d50c44e924cb6f64991bc79078	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1296	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1296	iexplore.exe
1296	iexplore.exe
1928	IEXPLORE.EXE
1928	IEXPLORE.EXE
1928	IEXPLORE.EXE
1928	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 1928	1296	iexplore.exe	30
PID 1296 wrote to memory of 1928	1296	iexplore.exe	30
PID 1296 wrote to memory of 1928	1296	iexplore.exe	30
PID 1296 wrote to memory of 1928	1296	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b4a078cea1bc784c6ca5242fc37705f8_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1296 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6be4dd6024ff4c99d7faee2ff1d36011

SHA1
c2d5359c2d08f000403a8f3e685f311b23395697

SHA256
71755c4d92589d80d54ceaf37cd3071005d5d00547b73aa6be85a83f1fa7f302

SHA512
f61fd89e681a4cd5fc3882bc4382335c6380e3fcdebc08c1ca7b6916a821e1a693b4769a830f0a949d56ce8a1461b68d9e180fdbf13fa3f9621d0109fbc8d2fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a66cff2349815172095224f20a4fb38c

SHA1
cb485d97e2493dfc71e7615719f88341e6f878a0

SHA256
1a172ee23211ac31316953c141e12f7fadf58e79e76399c6ea7cd86428696ea6

SHA512
b00e3eebb8db9fd90c1d9b3888fdcbbbf492703ce25bcceb67395f122219bf10c5a63dacdf1ace581f2dd38511e59dd04907a56ba9d06f9bfe1dae5cd76d9677

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22292235aba193742f87a9d6151223df

SHA1
628520b572bb99292fdb35ac751c4c81a2096c95

SHA256
2910ce4c841b30125b87a7afbdf94c303ad91a8e10fdd01b90756f09ac632ffb

SHA512
aacb79b7581d30832f07a205f02f87ac10cf689a1f9dc6ffd3673a5484158559b8827c4245885adcd1c8932736ce39bffdfccee6d019371c1ce430a016d6d6ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fcfb00ec01dcd7069cb347e0791c72f7

SHA1
002860e37b14437566d08d8ceedaa99284ea11a2

SHA256
b43e0e4a93e806e2d6ac6f2af067df01ec8c18ba56bcefaad3aae8c929980f49

SHA512
1e2890dd8b5f09742c3024881b8ee7750fc29840bf8adec5cb3ce1c8926376aeb6b3334726fa4f1fff191dceaee2a757bc2503dad23dee654f442788b2235074

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d5d5666602a8e0ffbcd756d8db5e888

SHA1
9e44c784e94e2e266c6e0eec473f300c26eebb58

SHA256
18da2d37f8e03452ae9df7de315f368fb532f8f2a5a2af7fe8f9a3c64f58cf84

SHA512
f64f19d716c68ba095e5039c3ae91d4c0bc5bc37ef83e106f3607d99d6840c56e0f64653306802ae2307a4cb7503d739f96e6dc78d1ffbfcd9a3c8b243abebb7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a280746ac17029d78d8825afdcbd8090

SHA1
42591d13c27b3a11931ead123f4d00c1708094b9

SHA256
452d6d816383a6edee6d417002a3aee7dd99d47f1e9073cdab8745ae764864e9

SHA512
ad96ee92c76d0106f8344e55d243d0d53c7b60df3cf1faaf3279583cc7a322cc263628f995514fbb8583665588780380716a216791d20e4451808ca475a521ec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f07f15baa16f0d2a6c36cb2a4f683f2

SHA1
4402afe5bd9c9ef21ea770fc3dfb41504c429179

SHA256
121e81cd112bd4ea15bf830f086233869d0ba87689e46a1d80c42258e37b1540

SHA512
2ae78a4a69be62800824b75b64d9318f405b0c7ab18be7b23ee7eaf7fea78d07d7e19c56e57d913bdf9e996d1f61e8930e03e554e5fad8b2dcbc16597956af61

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE727.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE749.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit