65c3dbc19eb534897a66d7ba966e62921d7f966341c7ac9275de110a05ef9d96

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 19:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c20395b9fb92d7d9c99887f022094a4_JaffaCakes118.html
Size

2KB
MD5

0c20395b9fb92d7d9c99887f022094a4
SHA1

eb8bbf28d77f4b936daaa5078a16f035ef45158c
SHA256

65c3dbc19eb534897a66d7ba966e62921d7f966341c7ac9275de110a05ef9d96
SHA512

5f017a375a1d11cc9c850f84bba25d9ee45785ecc51e544ef0d03c4fcf7127d4f8d77d86c02d9b85acf5cecee380047fecb991e65971969b98e1c38cfa5c347a

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000003492af286e6652229f49f519293d9b4d1ab8130875355548c1bcb0daf4883163000000000e800000000200002000000043dec357352f0defa0aa62af634a28594c6478f84605cdec4b9931eddb2117cd900000006608349ceec189842c378a3e74aeb6c5a86f64a82668f25cee3009edd53542f5e359a1b7dd66a460c63b27eebd11ffb5b49e2f859a83e770905768141cee97da0c20f8d7d59981d5e985819aa3121b1706b22537aadfbd1e281d360f17eb42dee5a87f05c4fa0e36badbe106690086d3e44b1e18c0c30d59de1d46bac56e6759a41075b2f93ad379bf15727bfaea934440000000ba2d24c4f24db29ff23cf207161fdae41e270b28e8e8fcc59f773bbb8e41411b2361ce8fdd3fc651d4fb5d38c951a85d1cec5c2ad23df9ccac9c7ba9a18dc736	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9CCCEF61-80F2-11EF-9CBD-4625F4E6DDF6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000e4049b553c2c0ef0cdd3ad469af8bb4026db0759735d19adb6a6a0cbd2ef65f0000000000e80000000020000200000007ef92a2b086ea473aca608cd9fb7b48d04947bd9998624e8eda078b22911b46520000000f7e9176a97a43938c5bccbb19b797e937f5ceff6317df8fe907f4b73e54399b040000000a10c6bed40a0861db93ab3056b98da20d18f6d011f1a5471d84028985ca5a3be0bea5c43076f9c8807f11eaefed275c3fa4a86a486647c650df8637c4eaf218c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 204b7763ff14db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434058364"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1628	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1628	iexplore.exe
1628	iexplore.exe
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE
2688	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2688	1628	iexplore.exe	30
PID 1628 wrote to memory of 2688	1628	iexplore.exe	30
PID 1628 wrote to memory of 2688	1628	iexplore.exe	30
PID 1628 wrote to memory of 2688	1628	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\0c20395b9fb92d7d9c99887f022094a4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1628 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7492ceaabdd045a30cfb43abec55c6c0

SHA1
67176f438111035a2d11fc423f38d36b030069b0

SHA256
48fe1087a6c0c48c7794f0574b3275ea521079d7cf44fcac371de82dfe9c8acf

SHA512
63b6a3ace3e2a941dea9495fd9887e6c38886aac2932106d68e710e54fb92366395cc42cf736d7486c8d2b662f99c9b0056f1d2650a96dd217c097796921ce4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
17d0331176b1a18873b6bedac08acc53

SHA1
799730491f72fc7246b7ed5613a2dced7d31c89d

SHA256
b0b1e629d5b5095469593406b41ea74c48362823d57bb1749e5e334281313a21

SHA512
427a4a45cf73478f173d14e4b169afb5997167345912587b423baa19319c154874fcdfc6912fa2cdba53ac38815878427a607e7a283a974dde441778776b1f68

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f26032437901dd657c8e84e54477b1d5

SHA1
153b8a6ebd39d224acd84515a3eec4b4ba530f32

SHA256
30ce33bec88123b4466dc4361c46052232e362e6771ca80c595b93f6007998e0

SHA512
9c99e3ad6dfc5c1199a4015f2d4e5069120d51260d72bd0529404dd2ffd52efb6ea45fb3ab2e5f9d0c18b01eeec3cb4db3ea641822b009c4a56e6f7faae99534

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9a5a4428591c0c702b0969acc8fc489

SHA1
a3dc076f9b8ffd16d4262002be5147508bb69f80

SHA256
6d653841f9de4988336ca0d6611f4605a33f9d28bcb2d65c6a2de491db34083d

SHA512
b417626a9c6a7b5e471523cd3ef411e8b604a3d2e6f0126fdcf43637adb7271ec38941003269aee90be0faff6c7a91eef1992ed5aef92ecffbf1a8bc268d1bb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c78957fdb254bcd68d07287576c3f86f

SHA1
1d3f67a68d849fcdb00b50f26501d6176396d2be

SHA256
093e53f04479ef26694e9316c9824a45d9618a5ff508a10a9b85e63d6900b66c

SHA512
1d15f0e958b7244c2f66da84a52254a5aa723790327a20063601ee0dbf80c0a76427f1cfb676d9ed12183c1f1ff4cb5a66ee7c5269264528ec07f821b94de528

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9fc42590f5590080ab6318938e2ba573

SHA1
abb03bb5aee3b74532d2918ad8cbc25c9c77394b

SHA256
968d91009555652a55462bd4225618db11dadf99dda7ca2a148ca75f2b44e45a

SHA512
a6b8e7f72b953973f8e313bbacb22ea529b55cbef2094deb2ea0da5975e0429f903c905788c306e35cfac0cacb5dd54e6a08901ab9d7d29b29c997b5cd5cece8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
561f092c1437072e0ed5c599eeed0641

SHA1
004cb64d93bce3ff8a5bbee22c8e0f1236e3673c

SHA256
96f30d3904fb0666e999f15359560e4e91ce014fcf019b9da5bc9b344d90d41d

SHA512
f97f94dd1083e5ff00760888d2e5149f1f290d847e9aee731c2c54ec429143414431ddf872bf71da9eda009d9fdc42cb59785edebf63ecc0338d7bd2ce009c4b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6207d32a91a6a706abe93eb3435e109

SHA1
ea1bef40e9e14e9d4df8e6bc49fda558be3d08f2

SHA256
0e76d95e50dc36a72eaea42b0d028e08ecce94ef46c93d37dcb0a9793c9ade85

SHA512
e7a458c994a8573a2ebb692228e2952599dfbb9bb7de6d23b66565bb411ea52f71dc3784ef71b3d005e37db20549944bf0074f1ebf45d497aa97e235cdd0ba1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65281b4676c4957c80d12ace5061c036

SHA1
44391af117bbf301790df46d573dac09fe99afc8

SHA256
594f6e2a571413b56b2efbfa034fd66a4afa8ab735ccdf120fff2387cb76455a

SHA512
9990f8df57037b1396f62dbca30d97790d82729d043a6c1c732b1e32ab9d6a9a7325b74d9dab9db381431420e4a4c190e38dc1398d810085174883fba0ca0d19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5970d1764d187a7e67012b4e048bba96

SHA1
db92c8aaf8d802da9342f93f13d757b7048b87d1

SHA256
9cac0109ce55b472913edf78cf341b4fa07e02977772398523a0727e7496926f

SHA512
6ece4721cb1944831b5c6b95d9bd108b225af78d3e2abbb46746abe7052a4fa0f54a803516c2864836e71597e092c2f091b809c4d1b3f33c76bce485dc36f905

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab319E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar31FF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit