46871148e75bc9661a24ba5fd193bf635dd1f33b8576b7edb1466123cd891ebb

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 10:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be6f3b725d2d14a77bcdd1564149edb5_JaffaCakes118.html
Size

11KB
MD5

be6f3b725d2d14a77bcdd1564149edb5
SHA1

8566a6c6542b61c1987f63edd9b8dab31d6df220
SHA256

46871148e75bc9661a24ba5fd193bf635dd1f33b8576b7edb1466123cd891ebb
SHA512

dabd194be0b145d7f53eb24ce7f152ae28326edc9e6c616d02684698fb47dcabac1e650558387d6aef792a55b945d733f187da7c1de6de7ade2421a4a7a32fa1
SSDEEP

192:CE9WOptucyPHrtwAtrd/jpXuTj5o7Bzgd2uJsi6V3xDlCvoW92S9V:zYOpvyPNr1pum71gXJF6V3xeoWn

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c70000000002000000000010660000000100002000000059f022d74c73b59f8eb02f8bb58556b616b7d1d377c2c0071500ec3a350d5423000000000e800000000200002000000041a27632665dfef344d4f9c3e281d8a70785ec660b056ebf5078375b941495d1200000005e2dc0dee97853251273d75075aa6fe2f6d576fc43e177632a654165b294d02b40000000634d3cbd438665bc428fde6a0123378da9eb58d1b9611e73285bb16361ce18695538d124bda1c333eb28658f3ad81e247b52cf76657a33fff3bfe3ddb232e14f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000081e8b0d531f99a41d4ea1cd53e40606784cbc1a2102f4a56cb2a3c8f016cbaf000000000e8000000002000020000000f0d23dc4d223ff92f11e74ebf4d68146d64bd27d433eebe3f27170911f79c577900000000edccb4bf98a1ed7f21c22f45edf6186e93ac5e0e8aec8cbc4db0340b3782f1819a34faefb1c2966ba16aa5fd6f74a5b9e7468ab89da1364b28f3ebc7dbac56e5a5d5d2678183f8df59e13718db99583fffbb13d092525c9e7e818d4772d673121d524610aaeedf29cf3c0db00310e364f5fa73c5f1680bb995f7bc0bb79cfd61165bf4a12508401fcdccd8c618bc20040000000b9ac2758369c24c516f7be44279b81a162f67da0f7c3ccf311a83497f862cd0f78494586b6ae3b354c1d2d89f5a78b456fa31e50fa5194a526081c1e371695f2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430658419"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7F1CABF1-6206-11EF-8340-72D30ED4C808} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c01fae5413f6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2308	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2308	iexplore.exe
2308	iexplore.exe
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE
2128	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2308 wrote to memory of 2128	2308	iexplore.exe	31
PID 2308 wrote to memory of 2128	2308	iexplore.exe	31
PID 2308 wrote to memory of 2128	2308	iexplore.exe	31
PID 2308 wrote to memory of 2128	2308	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\be6f3b725d2d14a77bcdd1564149edb5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2308 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f4000c1638d42ead4b475de60c38757

SHA1
8ea9e0258565efa27bce228b6574a155e9d84935

SHA256
aa6debb47190621920d8c896f4672688abc736f2ddd7e02a0121bbd1f759224d

SHA512
8b9e21cbf62d82a2d524f33bb1dc94e0d783d2ef1fbb2794a563a29da6a905eeb5f4b94e3806c7900db34cb835beb08b9341630893a5f941afdb89f4c292e054

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3acb523e18c5eb08f60eadb451dd375b

SHA1
02f8a552cd7205d8eda876f45587bdf9243a22fb

SHA256
120ea6b62e2256ece29b964b086921b16945b6f9136dadfb518baa87e9d1d63c

SHA512
26f908d06f3e72cc47c01e0acdb3f3132bdf8f862cf3b8c1c2a52b0f611c9ce3d9f011fcfbe2b22f5060996e6b4a33fe81b5fc45cf6fe8cda16c3a6acb0416fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7bba23ed5b0d39c25f02b27b3a2d8302

SHA1
9846a965b0fcc8be8e757fdcf14b555cf17c27e1

SHA256
9ef56b6760fb70f4fbbe94a344692e3c5a66e31a63d225e808962cacb6af43f5

SHA512
a6e142baeed38aef7245966a3eb498956da98a5dc9229b509a5d1b9b6a6e2b0049218fe2dc47c65e84159217f81f3ceb037853926f9a8b8b2153999553bc60b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7cd289f1f89d07a35914eb6b6095caac

SHA1
fcbf1dcd26dc3c9996f0409f361edf550a1ce5a2

SHA256
7f6d362acce1e1a383f86eba5a76f12d0c3e207aff0ea67a7b6e8918296cf6b2

SHA512
68f5b36b72bca4da813228b252e396a136f6c7d41a1cb8f13220ca241d612fc04a7f78f30e7f068d8500d6413a5b8fc5efc521acdcbe2332b6c0aac64612e04b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45e1777eee8988d7dda94d4d20a81f18

SHA1
0d577efe3fea162cf02f198b7feb2aeb0d15d6f6

SHA256
adfc5b98ed5e97747063a3b130dce68a0d907aa862343e5360c3e1b083af70c3

SHA512
be14c678fcb139da5caad132b4fcfcca90a3d2f411b33dbaec4a5593592f16dd74740d4e1f54afdae18949019209f32d0feff252228cc026f7b3be7ccb0cc0e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90ce8add169ade37ee7910388db91424

SHA1
633c9557fae7f69e40d8250ede485d25eede1231

SHA256
dff0628eba6948dde2f99153a09684434f2a9cf3ce745aa73aebac8bf114397d

SHA512
c4a2d45dc00a75f44e2bf4d7b0fefc4bcc802c0052c822d8dac0be96af20b4076acd3d1299c1f9052f1a285563717be590aac4becee9d69e0bd5ea87be693fe9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55fe1d92e0dc21366b794e76a2798501

SHA1
fa5988d0ac79e024d64bdb72fa764f0c2eb0b232

SHA256
6fb210f8af3493f37e9cff8a0d181d0293673430039b05685c452863881c4b33

SHA512
b7a16494bf82ef87036e7ab9271bcb270b4bbcbce894cd2af4b68d0cbc07ffcb234ea30b38b4e68f7aa9237c09eae7e7f9ba747ae2b3ca7cc8d67d3b1b1044c7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1cc5a3ad96f4a49a4c9dfb1eb69c5cf5

SHA1
2217490a4124df7acb66e361ef1447bdc3661f1f

SHA256
6970099dd13096c1cc33f4997ce1041db9dd4853117f23ae0932018c4d3f231a

SHA512
801d5e4270508e47755367dc6b15e8bb173a0e79d87c7c8adcc30e72697402104098b3a55ba7ae067940319d01452ab66ebad25a36843d89aebca5751e55ff6a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d08fe9df4d9bffbfacc6af9aa0cf3a95

SHA1
f4f75ae0fe5a10037ea8f5fcf6517203ab16f8d9

SHA256
d78742179644879d84b07756e7bd4f741fb42b73619aa91b82729398fec19013

SHA512
8b461e8f88168dc8e6c59bb8df2268ad99a6df20a2f7cf16de01d5ad340ccffc51d748c1a9659590aeeb2f8ca519180ea5ed4adefc4584473b5a9995231d1d45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8c7efae293dbb430eeb06f1df97461c8

SHA1
28230bd0ba0fc0c856c1d31c120ef8973f1e5297

SHA256
047a0dd2c19b9bffa56173ff3f91ee842eff486b5dec187813e9822bc304015e

SHA512
71a9cd3f71a0d0633067a359f0a8dbefe821f6e1d36d1ee9d962795ab72ad96cbcfb009ca40103e776f35eadb3ca9b0d5ba24b28a3b21cd408586693319a6803

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
29b2aa4499ca7a924e713f723a39c083

SHA1
87f63ba4843bcccf4ab406ad05bb029a0b478651

SHA256
625a7101633022e2b438fac6b69f480a1b85e2bd7c38524f55fef16123685d81

SHA512
e7fc23fcd4ad61974ec970fff525a7c86994c7fd0ba75cf727699a9a211d4b007aac48c3dbb972c1c1b30ef568dd3104631d1459b33b4758105998752d3b54a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF6E0.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF750.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit