ce10d22c1623274d23673c26090a232995ea12e89f46d21e35447d53d89c1dff

Analysis

max time kernel
119s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 08:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb0234b29de1e083529f8c028eb90d3b_JaffaCakes118.html
Size

20KB
MD5

bb0234b29de1e083529f8c028eb90d3b
SHA1

e9c8ba5f4ea644be2f8dee9c798c96a56d3a202f
SHA256

ce10d22c1623274d23673c26090a232995ea12e89f46d21e35447d53d89c1dff
SHA512

8ab3969351709ea51c43629c8fa88cfb1258691841247fd11901ca80e6b4b8b4702d0e0f0c6ef24e52603606915108b1b9eeca468582ec50cfb787f8d4eed9a0
SSDEEP

384:qzgPgQG0tnL+hh73ckfxnbSnkfxO9b5cBn1xuxMrY9LNKqBYnZTeNBCpM:qzggMkEkfZYMnqBYnZTeNBCpM

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1F43F211-612A-11EF-90B1-C20DC8CB8E9E} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000f88997b8194436f5dcd5fd242b30a3e79f1859dba559b3f802213936c02caba3000000000e80000000020000200000001e6e31b4c2c7edef1581c1f0c6e7a951e1d4321e546fd7324a03c2228e194cfa20000000eb669e3cb305ec184ab51368fb416d1d7967121bbb1983908ba53d52de985791400000000ae9cefb2e9e929a4d68dbbd51675e7036bb7d7217f4ef9b0d711650e02611a4259da2dc9e286c3c7215d5567a5f513f55750f19a2cc7e4d2ee442379b363493	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b05efef836f5da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000008f4d52ab855ca49887d65d8f9e5f0e649341b384a8968ebd4f274d894ec96e64000000000e800000000200002000000091e48c103827e1fc5efc57ad6e727200dc45f24dbeee5eee1f988c39e0713ad1900000002ff56b79d682a27b32c74fc8e2a66a6196922f6b7938517d9fc470fb7e034835dd0a6e38c0097d9224d04d1a9e6f841d8ca9e575785b49ea90e8479be85cef20f10857aeba612c9866a4d396f78665f7a0f1783d53da10b2de5bfca0f5d5b384c46808371e8eb6114acc53693c22aa665923a9283958e57a62d773e2591d905227a6a162895edbc3b66e557977cf62014000000035799847a6dacfec8469b3ccd2dcfac9a77d7efc3c5a25e0b413b6da0eb71b260e9af501854873cae3cdd062c86407dce7adee995bbced517bb8fe246507e887	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430563769"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
816	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
816	iexplore.exe
816	iexplore.exe
2444	IEXPLORE.EXE
2444	IEXPLORE.EXE
2444	IEXPLORE.EXE
2444	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 816 wrote to memory of 2444	816	iexplore.exe	31
PID 816 wrote to memory of 2444	816	iexplore.exe	31
PID 816 wrote to memory of 2444	816	iexplore.exe	31
PID 816 wrote to memory of 2444	816	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bb0234b29de1e083529f8c028eb90d3b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:816
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:816 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b5980111e0e8a75011dcca0507c0c11

SHA1
5d24099930199494484612a6cb457367810d7bcc

SHA256
8b676478d9d72901426df8ef1a82aa719cb67e3f0c0b8305830322e3c289b5f1

SHA512
0d2b291af43188e7fb0d61f3a7b4ddc4b4ad351ab3c8416186b750ebfd306e2eca83d5c0919dcad84711f9bfeaa8f2a36d15e6e0046a279b0cd4d90aef1d223a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
287c00805bc562633e2937637676b005

SHA1
0a84dd6f1a3e367e5bfbf7cb2c9d5fd24cad581a

SHA256
ee61ef246520b8f4f1fe8758633dff33bf96718d188e3cfb17f0a106e4c25102

SHA512
b1e8462067645dbe81849551a5160289c00c0281d026e4cdc982a2ccbff3f6357ff0d22a3b68bc76ad1b399205fb9f66803be4882f981fb0d3bd5ea91ac7e9e1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed762840495f166f0e4ac7e673100e65

SHA1
c2b65631e7823ddce56b3a98b57f505c602b759c

SHA256
c4038f397e5d2b076955cede06e79a784bbfcb1295b452e999b670799493291b

SHA512
5fb7f6da4b29e97fbdd1bb07e99f46dd601ea9716cf521dfb2661b045508d300a53f3931f084fe0ab36b6c929b603fabf6d6d4f51753724b25cdbf46fbb0d352

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
be7900fabfb5c42434a0199baa8fd3bc

SHA1
2595bdcc0d4fc9c2d95ccb76a53a48b6e921d815

SHA256
1d840e21a7db680c91ef0b122b1e7181c9bc42087c4c5b918e4c4242818ac6c4

SHA512
5ec3ac10d451dde99b06c114a24668791e2bf2bf5557421361154b11e14344cedde07d6297abb0d1b45325161ae7860441bd2ce192eed2cf60dc36b72edb32d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6f0eaa80ec7570ef69dffb9e4c12070f

SHA1
cc3e5c264e3160408a2b124ee1175f67e0496a40

SHA256
1b252d6491ead15fc80bce0a192f3ead6c64e8244fbbc909aee50110b11a771c

SHA512
caf28bfa3d23668a96156e40742006c0b1944a6505fca05765d103de94ca1a01b496925b234fe0d064b5bba28eae29542c5c3c880fe12bfd17d3747d2842e168

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85fec3aa3c61222822d5db2eb6daa948

SHA1
f39846598df16e633bff11c73a2ba994338219b1

SHA256
7f63343c2b4dde0982681db38a2546e809755f2dc5e785b4e7321b423cd92571

SHA512
266a0027f7a93366b697c2abfcc142f91ad9e4e168537e696117f22d47a31568a6db43702bcb8a122eaad51a3b4cf6a1665d5794b31ad75426933256ecc03376

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ad8936cb4636bcc0f0e22df50d7ed637

SHA1
fd869472e8a242956f743f6b1947677a04cc8b23

SHA256
c26a3fcd016303bf442543078a55b628ee5c9841b7348311db9406725a921423

SHA512
6f27840afb06734968e131abfd192b020b24881d1b84635d73a6b2d1783b5317e8ba7b58026bc1e2da9267828b972becd6c69d834bfdbb463b67f464a7b32e08

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1f4d44e24a7355101284c8f426b44bc

SHA1
4e970ff9b2e494ae60045371c8485b8ebb68871e

SHA256
34d164999a0faec5ab7547bbd60887c8bcd7340ba9cac8c25915d1238ff9eea1

SHA512
daf1c1ee2b09fb9c83763cd8fb7fda40ff3bf26950ce4c0baf84818fc38baba02d5cdd0abcdca11b9df3fd74c0bc37990049b4145a1e5d9c3e1008d4fe82e6ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
197a2bf9ff86d47392e825b61a5c3520

SHA1
76779385b71a656e6063cf4be9731fabb6b11f9e

SHA256
c5faa3477a324deca3b0cba8c579701ae2d396da3fe8943436fd0e0a28ce3919

SHA512
f9435c3495ee6cf223c288faa0d4c8737719c5e2f013bdb5a461864a748439246c8193e08c2e3ca655d794f410bea3e466a5f519b48722d5ba2e55849f405fa7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a2a211a24184cfb6aca7db5e5869952d

SHA1
0a758f4e7845804643e876b67a5ccaddc1b1ac1b

SHA256
6c35486c64a5d028b4d9640365c278820ee43de5d0163a2bf6e265ca9f4e760b

SHA512
f469427cc24d1ffd9caeab4091eddd5b72eb8d0080c8355a0549b8124c8123d3e688e78106291981d538ca2c23058576fb3c454fddc7d45784f488ad89fce42a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1577.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar158A.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit