a14ffaa71c0211601f98f96b08f0345e5411b676bd97731e9206640675567e4d

Analysis

max time kernel
122s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 06:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

122e3594cd96d79f62b91b53ba559fe6_JaffaCakes118.html
Size

213KB
MD5

122e3594cd96d79f62b91b53ba559fe6
SHA1

ce7f73e8f7bf73278c51de406f2164c3774c65ae
SHA256

a14ffaa71c0211601f98f96b08f0345e5411b676bd97731e9206640675567e4d
SHA512

8f723f5cc1fd44eb81b61ff2eb2add188c1fd8976e0d7ed796393c0dad994138fc49644f05d5ccca55c5c2b3d3072325ac42118c67870914b2f491e87256724e
SSDEEP

3072:6rhB9CyHxX7Be7iAvtLPbAwuBNKifXTJVv:Sz9VxLY7iAVLTBQJlVv

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50c5a3512516db01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434184605"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea220000000002000000000010660000000100002000000055aae50a1189d9f5ed8bcb83eadb92bd54a977bc990c213e6350f3381383ab45000000000e80000000020000200000005c6211c0c1f35174628f0999df76e676bfa1c70ab90bc4c1b5c82a3d008df987200000001d075cd9b11bfdc491af86dbfa389de77fe2343b17b9ab1e02f9bafebd83eb7d40000000dfcb0efec31507807f13ba7c04808ecab829703138f1d8ee5057c25a12285a6ce0a70de5905c6f5cf2fd25cf1f8b40d2cf976b958683c8b3207fd7d37acf0e79	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{7D2D27C1-8218-11EF-BA5A-5EE01BAFE073} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000dedd5830fed86f43fdde1396051bebf162e6ed7132c9a9fc757705cc1aad3e69000000000e80000000020000200000003b4bda2fa2ed58b1091bf5e918050a55aafcb9d52e0572f02df4a17cccd024ef90000000b6b94d0dbce488398e165f30eef10244cfb0b35aea17cbc6652915fd02e88778f25415fc10613182b3b3186b4987187ba7b9d6543f371a2e559270a671b4cf09a1af178a868a25028afa562094f17195834a64c051b56e5fa5a97359952da011d8628e1cf734efc8c6b40410306b69af2372fd870f9a63a2187a999e91d0d4d1f61a113a456756842d46f13a3d2f13bc40000000a0e12d923eaa87da1e1a0a3bfb976a66e752559cdb0a4a5709b853f4a90171f4e9f42ca9e036d6ca8f70e5e68c6e925ed82d43bd8d069845af730872722d0bae	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1656	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1656	iexplore.exe
1656	iexplore.exe
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE
2260	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2260	1656	iexplore.exe	28
PID 1656 wrote to memory of 2260	1656	iexplore.exe	28
PID 1656 wrote to memory of 2260	1656	iexplore.exe	28
PID 1656 wrote to memory of 2260	1656	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\122e3594cd96d79f62b91b53ba559fe6_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1656 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2cac6fa15355988c293026e8628e4602

SHA1
f58d52f970e3058f4d342450e4cf66de1dfcffe7

SHA256
d0e5ec392115aab30e915c02e915afe2714cd939f1c0b00c94735de1186a87cc

SHA512
4450615c5f103101e650734d1e1bb0fa5076e3f7e1578aae9c49dcf91d7f0e515272487be1ea582edb1e464d3c053d139d57dc673cb3718072d0a86ea9aa6249

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ca0d37cb87718df0bda4eceac68b8d5

SHA1
f460189a8bc7b6a2cb3821913b5b8017d5cc9106

SHA256
cd08d3e5080845ce36dbfe3694f4f9e2a62bd8c5650aa2543520bbdf5eb55822

SHA512
e9f29a45e3296a8c2f1da878ee531d64b078bf53bdb16ea99ba17a1bff58d103320771bbc4cee3dde1961f6e61d5699dfa7938ee7778b1bef2bbe6a60fc54c88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
02f43361919eeffb44115c635a4825ec

SHA1
9fc4d75ad861d01d4343c74ac2d8a64d47714414

SHA256
db8389543e118da334d8727e1f97be97821407f715198a36ecc0e786e83b66de

SHA512
2c05258ffe998e35f4dd8a1b7225da03c0f6c941dd7a138c4114087c8cf88eeb7bd5e91f227cae9fdcbf5591106ee04d4c1bf7cb27a49667321c50cfbc3dce55

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62787493b8a8e11e9342bb57dfac1c5a

SHA1
7c6f1b6e3c910df3ddba6f739816635e1bfc41d4

SHA256
643b2a9dc145bb4c25ee25aca8755e929397242f389c3dd855e87fe27f960f32

SHA512
bbcf2087b27d7354f76012d6a24c04e849aab4b65380041331b12aeacb1551197e0453f9842536a8ebb1ed8e7f97c839cec8d54fa47967d5fc0dcdd04e9bb371

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b37fb189b9f4d759537bb189684ac2b8

SHA1
bd709daed4c10b37d008324f008e6d0905c60857

SHA256
1c95a4ce2b3a43c3e3924206ea6f735bd6aea8788ee5d72dcc4136d52a26589e

SHA512
e0dd51feecc0debd43dfc2faf687562adb37a44e0341892289de8186591a48591ae03c2796b15ac031a9cd414e230cea02e05592f7dd850fb5c248fc7ca16de6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c0813addf8ac3da40f8955b0454fc75

SHA1
fa294bb6c5b28c966d006a8037bdcd5869339b92

SHA256
3a41a614d3ac229649563911a276dcd124de8eb62fc57ed58717da127a46ed6d

SHA512
faf15760422010945ba99fb70a1be1c273ca1c2877b296b64a0dde59d0d45e7eea6fd9d51f946ec2e85e3ee334fc442397c4e09efdc2ffd435fcd8e4e6ac571d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6944f58f75e58cb41f27c8346e54a905

SHA1
5498889ec976de6d403182e0e926d6eeead42771

SHA256
014a465a9b138ed1982c43ebd0edfe192c6122c37141194e94003bf76bf525a3

SHA512
38e7c09e7f5b3a3ee71e275fcd106de7f77403437b372344f7e6ec371b56508194e1592a0a68751ad4f32d9c1af5b50a8f1a1c3d5f895ec1f906dfcf8e6f852f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b246c6cb1517dc789251938aea9da4cf

SHA1
66d181ea65e8b0de279446b47080c029123e6a74

SHA256
84a44afad4a3c57baf9c87066baa0fa1357473a2078a85059cd1516617af6c15

SHA512
d943491bd6efdf866c5b5835bdb9beeb013a8a86eef107d70d94bf521bfcd15d67984c61c5378f5ef8e0583401541ba722a00ec33264257a619847f120d3dd1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAA35.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAAE5.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit