e86afe26d9ea374bc42101e4e143c6056a1cdd6131a3d275bc98811c2624713d

Analysis

max time kernel
68s
max time network
134s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 21:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

078eb2e5facd94ec04c15047001be8d5_JaffaCakes118.html
Size

25KB
MD5

078eb2e5facd94ec04c15047001be8d5
SHA1

06da4b8b6cf40d9e4833b279f799c7e7bde9e8ec
SHA256

e86afe26d9ea374bc42101e4e143c6056a1cdd6131a3d275bc98811c2624713d
SHA512

838169134cd388b62d4d80f6a95e19afd02e37aa97290b02f8f11ab52a4024adbaca0fee5467e2b4fbe8d16140e3dc555fbce0b4413c2f1dca2b8ba2df37bd11
SSDEEP

192:cJkw/ncyTd4mlnJlUdc6UqAa9ore1Z81ZQY0nBWqW/RbA8qnFnQWDpYygf8KS2:cJxcyWldU5a9ie1C0nBW

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000ecb42c33568fa6e6a78c51f011f17da841876a9edf050a267db8a008ebc48350000000000e8000000002000020000000731d5a2234023fce0b6a822fc4b2853039d2b47e06b991bb4d95c073a2d0a750900000008a0844a64c240687a8e8894dba67a5d62167b233ebb763700027888615d20e8285d4102d84b03ee772151818f9aca22c10c3b44ab13a7b4cb77bc31eb47db9bf0d8e772eaba1a31dfdc06dd6f778ce73337ebed717d958574c8984d3a929f2f099be611fc7339ba54a93df4f7794a9b579917bbdfd51663846e048023b914cf1b8e513262e59743a43f744aa075286184000000031f5c433c477e6252827b0a65ce8c3481149ea42333780eb6d210e743d0f1fc1da0a12ff914c46a09cbacf0af737147e11e1b2d8423841d6ffa15843d40e8a2a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20cc37034c14db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000007b88b8645d6de74ab21efaf0de98379b00000000020000000000106600000001000020000000db66d92b7f6340d1310e8bc84750d51b1eef3112035d98f91dae592e7f72c5d9000000000e8000000002000020000000bb4d1e85b94ae717ae75d95b797ea4f915cd824011500f503080f238efa653b920000000a2953de94176cc379b1ebbece7899112b8a53991751df67d7aac5812bb17f4eb40000000e2f697d9e561d0b19bfe79529397c8d6fd14ef2f43b412eb2eeabdd3c299749edc2ae54e3c71a67b63a5e74b2bb3e9efd77c96f3426dae95557ad56a12dc08df	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2DD80711-803F-11EF-AD26-C60424AAF5E1} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "433981300"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1288	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1288	iexplore.exe
1288	iexplore.exe
2432	IEXPLORE.EXE
2432	IEXPLORE.EXE
2432	IEXPLORE.EXE
2432	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 2432	1288	iexplore.exe	29
PID 1288 wrote to memory of 2432	1288	iexplore.exe	29
PID 1288 wrote to memory of 2432	1288	iexplore.exe	29
PID 1288 wrote to memory of 2432	1288	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\078eb2e5facd94ec04c15047001be8d5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1288 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c995e93e9f7f98447bef1d26771bb39f

SHA1
c1d72068d773b25a27fc2624ba3e6e3dceb7e466

SHA256
e43223ee35b802c33db9daea7f602facc72132d62836fe643d86892822e17404

SHA512
a69501c6304d95422c61ae1349836f766a28bcfeb92231a23d96940fdf5310690c6a2ce9065b7b9dcf68e3cf05454b029d12f0f7ac98d00fa56f026743b0fd30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47818b7dc688d9dacad3c7119628d0b5

SHA1
09801c7915b273289aa45b0ce06cb7acebcb56f0

SHA256
538aa1178f174c26a7ca92ef367c9084d03f279a80eae760264d5d4d0f1ed169

SHA512
a519ada76ca2e38d4de56a7259d54f7df8b918720a3f3a20a27e9e730912bbeeef20b94cfec7545a406fa86498e0595a4e8532c7a98a0a50df415cc9e40b19f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8aefb37188f89b96acbc89f70f842193

SHA1
c037518c422b780eac6a97535aaabe47db633f14

SHA256
c7cd9dfffd89d499eb47287c0f07fbbf3642ad8ae8a40b35b956e8aaf71a3a79

SHA512
30a545b45296a572a9d64a9792d1859f07cc752486fcde52812ea8373eb920ccec6a21a5b47bcb4918926fa97aa6fe9f377378e38f86af7952af8fee8698d6b9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b24d126e55126fff9ff8f315cf9e892d

SHA1
6ac55f9e5d75e79c331b3210458bd3246481d365

SHA256
dd378a9b983a85227f45e7c7302d519453e63039bcf3b8ded27cfc5bed84d47e

SHA512
d08a31b9a47d3eb96e9840e55f31b4ca6133430f8b11b3c02db26d71b6d52167e7a951e1ce23f5dd649f02fd370950b552e2218000395668d4eea528878382bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
373ec1e31d515228689b7b7c469d8e42

SHA1
9f11d629df3585df69a314c21c8690867c1f3312

SHA256
a0e192a01ead2072d2728beb3d03cfc5b86ccbb945abba5d10aa3342dd3cbc55

SHA512
176161b667245e64eab087b798d3bed29dd2921a4f0b441018a166c464f3bbcdb7c83eb9af616637437546197b5d8260afcce59c71977b8877b57eef8f142444

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c37671dc63e163092711f411068829f0

SHA1
e206e18316925806701b8fd4c79c251493312068

SHA256
ef98e1aaa2ff25c478556a61afb9e6ae8b5d9176b24894e8f1bed2b1b2f19c31

SHA512
ba39ec0dd0f9bf988e21051b36953eab459f73859d972ec92fa92e7993039f9c5b5e3154c5e511afd5918b77fa70929e4ae7abd893261e52c84e19fce9843ee6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
54fa164a689534059e4a56d0c05c5e7d

SHA1
e33701d28011c385e23844c8e3bafd7257936170

SHA256
3e6a8cc14e51f6a5d0c7211a6734ea1be676111792338f3bac6453a3a9ccd43a

SHA512
296dbe04da7857a832e42a57ad206163b560783125439ce0fb2b59dfda0780223d489deba811fc74d6ddf152e3eee8ef30f29d54d2b4e9d20484fdd53bb3c40d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1a26d0811b176c17101167856abbd18

SHA1
2606f3450106d48e94ac492704652b972c17a30b

SHA256
e8333f586fbb5f76a94ae9874554e5edd9710374670c6aee2ec93556706f93b9

SHA512
7940eae782fd578ef5a6cd376d85b5935adffd3a02345166a690b1761c734c905e316de5b1f0dcc588ffbcb7dd83260b1e809cbbfcb0dd0f6bf42db1b4c65fb8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
80b298fbc8f5b150a8067f671f6c5c66

SHA1
f2cdf13db46674646311a0db1c7e865a3403c2ce

SHA256
55ee3226305bb721fe8bb129f4705006ab0dfb876372686cc9feb7e3e81e7382

SHA512
7afd3d8dbba708207b3e4f4f48c0a36c18a03b2a0dd4900b013e8363fef11d51ffce4234be3e5de202c8579e6fe6bab04911194b54c6e2dfdcd840293ea78402

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
873a725c822c52f1e0645ea58d2d9770

SHA1
ce30059ecf0c4f310cee9b181f1a95d47a062f8f

SHA256
104b370ab42d113e0b9cd493dc96363bc3ca543104f55d8d0568a8648c38c29b

SHA512
d6dbf2b763e8c6d90c65babd2fe8e8a8356efc2e57aa0176130dc185ba3c59e535d56313ab6afbd4da67a15dd9d82fe29c724194b7d48b78f0652caffdfb843c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2899.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2977.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit