b8676ab015628933534abec41a9aadfa712e6b42931108db6d2775682b0ffbf3

Analysis

max time kernel
120s
max time network
142s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 03:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2a734759abf5e302a86908ab2f3af4a3_JaffaCakes118.html
Size

9KB
MD5

2a734759abf5e302a86908ab2f3af4a3
SHA1

f4ec28a3ee054d1a8807c9ffda1500b117dd0b7e
SHA256

b8676ab015628933534abec41a9aadfa712e6b42931108db6d2775682b0ffbf3
SHA512

03f22e757fd24b349fa10fabb43c6d4478239e83c75b2b625fe9e74828add062431500969857658c12e321f37542a5b948ac723f1ebd1c8102fa90e22ef56830
SSDEEP

96:uzVs+ux7MhLLY1k9o84d12ef7CSTUVzfzx57FBcM/Nd/QeuupJxv+yUGyY+eCxYp:csz7MhAYS/TkjYFTXb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{659BE2C1-863E-11EF-AC29-D6FE44FD4752} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434640684"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f8756c4c5f92d846914cf4cae89e706200000000020000000000106600000001000020000000ac889360535b32a97a1ef22129cdd3865f1a97ac251eed06661c67c3305c2037000000000e80000000020000200000001f0eb1e199075cfc42a198cb73eefcca36aff7a6d2ddac4897176af79eda808620000000c64790428bc595a78ea153c8400afa79c75ec5efa10f0542141be83d991fe07e400000006096941fe1acacb62a78e5c8ff85da7f852c1d433eb83fa39e5eceae5caaecdcc6913f5b4ce35f82f8c3861f447c6124bcb79c0b2e92984390085bb95380593e	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000f8756c4c5f92d846914cf4cae89e7062000000000200000000001066000000010000200000003c48ad068797e21c0e3c24732a2515e5e0cb1d3a448aac2dc041d60139ee58a2000000000e80000000020000200000006ce21f018a0e4c475e77ecba6025e655e7ae392652714fd425df121932c1625c9000000024a0bf74b0df62bfb5055b7615d3615c2d834d531c751c09d3d5af429693eed9c41c0eb47b6156883244a67ee0561fc79e7185afe63f5b95fe55bb3b13ca619b1985cdf367364bfa8b0266b6677b1073128b908fdc117e272e9e5f5ccb0032c4f44887bea20be0a6aae1fcf52bc710411dde11bfe2bd7ad419d5f947694c3c64c615c6043b21c3c70bb7df5640784c5d40000000e2f146b6852756d700a5e82dcc7f2f1e9016bf369482b6837a5ff8969de5e6c09a696e693f5d8e82121befbf57c82afe5b6d1eb1978bd0f64898bdd1c570729c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c039693c4b1adb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2448	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2448	iexplore.exe
2448	iexplore.exe
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2060	2448	iexplore.exe	30
PID 2448 wrote to memory of 2060	2448	iexplore.exe	30
PID 2448 wrote to memory of 2060	2448	iexplore.exe	30
PID 2448 wrote to memory of 2060	2448	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2a734759abf5e302a86908ab2f3af4a3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2448 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff55d2659fb711195d652e50f1246b5a

SHA1
4112251ba27db80f6a1483f5029a6ea8ba65597d

SHA256
58f698ba4eddab8d843e7c6ebdd4c6c5d866ad53ace5c78d0ce2aaec7f949756

SHA512
ec446fe418dfa368b460c4adcad11a9a4f8b90f1cb8f896c35d9f1abeaeebe2b9fa66a04113a852331ce043ea37555c3506c7b7c5e61b1008404a702d9a2ea53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
30f6d418061841bc4056625b0e0eaabe

SHA1
ff97e0dd8fd5176aa5232cf0ec9c26a93b9db328

SHA256
6b8dbbdf3169ab4c73a9565e139e4122f610ad792e662b4509bc257b925f883d

SHA512
1cec6f33a14726ac2d2213fa5559d38c030228701ae911c1d5da25eb21f22d111eb08e4d65daa55dad676acb740857c5b17b674d30505be6c62882661c2345fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
060dd8ed262af3ba9dd463ab214d950a

SHA1
2b1810dd34d6d480179a98768eeba3a9ad82ff30

SHA256
91d90665c7ada68eff5082bb9f4885763045147ca435e5c43fa2a59ca48bf9ac

SHA512
f4a3b73ea282d8014192bf683d63707ce5da827872810bca19928be8dbfa80e1b2ed183f83784fb501b514f88051255d57b95b4fa8b10864553555dce6874675

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba8e4ce6822d4a7f419eb9f771576cfa

SHA1
76800bb14310d1ca667e76e7cbf9b9cdb5eda54b

SHA256
a057937e4f8701dfad70326c752fe0e509b490dc8fddcc62ba7ecf5c51edaa18

SHA512
8c7576e37b84339eed991a8011b3792e86a36003dd1955d41e9b6e56a98144110d23823218f4cfbdafe7068fd995ef4bd82d125cda79980f117cd74feaebcfa1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7bf8e115852dc31ecd72de17bb17eb9f

SHA1
4422a9b7727d9392aa051bfafda870c5f4c5ee49

SHA256
568a14ce11e33a105df0e72bc83a70e52af62c9e96420ffcb588eee7f577d8d4

SHA512
3062af96f57455f22c9f78cb028a9b1a1294c348e0af21d0ecf330864e8eb493def6f7cfe1e69dbfe1cfd3a623f8faa065cee96b0bbf5ee4da5df3ecd73b3553

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a3c773dfa78ecee8394952080e64cfa

SHA1
e8f5b83ad59367b5bcd7edfd4144587ec5b3fb3d

SHA256
393894324f684660340de0d2562807ae1485e6d892848d7793440fc9fb88cff7

SHA512
aefc6b916add65b670dba729288012e4a891723817d0e516d64d8606b7562350df1330e215061934d85ff6468a68d6de31cbe94a714dff9b94064d6a0dfaeca4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d08fb1239172af73c72feb572ff08cf6

SHA1
04af4a185069578546617f364780d3c5839125f1

SHA256
0e807faf2e49a717ece6a8bc1c2b2f930b889ce335e353d1bb6d0fa127d90402

SHA512
5b2d1dc9a7e999ae0330b033beeb5db2036adef1867269ad3aeb218c03737d5e6be89daea825400ad90787beacfa7d6dcbf6bb7d5181f249c72ab8c32cd27e3d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9dac7ebbf681262de288d4f4626331ef

SHA1
53cf2e14065b88bd9760888c459e95a093fc6422

SHA256
bb6dba9596b8b7704700412709baf5c6a69b6887f81e530b5407d89f39a7f660

SHA512
8c8680db6e391eea0bf8969183322fedb8970f691e74acaca29e77c594afc1d9f616b6f6c6b0d37e11d35fef0a82600c7e9106eda6f44dcd91bac373f00606b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63dcdfdf9fbf457dd6460aed5ec7d466

SHA1
49e14f06b9ebe19282190400bd38220e3a8b7b62

SHA256
cd27c70868e99a780a375dbe6b299d04997f720d93a32593b236ef0a9df32301

SHA512
65df30d0bc9f0269d46c32f1bfb333b2c6e7b404c0e440b25cd78ee93cafff9619f0c352e1ef5d300fff9264761d544de2a23920a2c9eed264ae8816687e70d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2B09.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2BA8.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit