aa67b055ce68cb018e2bd77191ef5a5e1c1c8d5b5c2a70d84ffe8b71ef6ac3d5

Analysis

max time kernel
134s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 06:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c8138bef006092439107b3ab657b577_JaffaCakes118.html
Size

67KB
MD5

2c8138bef006092439107b3ab657b577
SHA1

7a89166209c6b1f117752bf8998c4aa0f8dae449
SHA256

aa67b055ce68cb018e2bd77191ef5a5e1c1c8d5b5c2a70d84ffe8b71ef6ac3d5
SHA512

c5c3c3eb3ec25e4803ec55a90e834401e6644916856479dc7567b7732340edfdfb6eb2969c67e6f9d2e81494ba698cb58d0c0e9b2884a35be0772c75a0814d9b
SSDEEP

768:JibgcMsSZ8tN99OIsEXjiBoTyfQCZkoTnMdtbBnfBgN8/oygcR/QFVG8c//IjkKy:J9WbTePec0tbrga6cuNnzIjv

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000193b41fc3994284c941ced3de1b4115600000000020000000000106600000001000020000000c9b33c17223860f395fda9ab44b2d5df9503d2798616b55396f1a33037a0c0b6000000000e8000000002000020000000646dc34387fb54e54162f834006293df9d2914e009b54ea149034c2ac998ffb990000000d8543fc709718633f0916b0c6789dfdfb5c960d3232b696e2d16f195d37c35698c122af44a03d33a6befd98f589b18fddc18643e3adeb74c9d2c5657ec576825464847e09b6df364aa63f54a163ba581b1d7d5dcb00ffa5ba41f1c9d30dfa9f05cd4c4770eaab6923af083dc4bcb43cc003339364b99b80f89f6b19f142f721aaa6434346ac6f47e02b879182c172299400000009dc5d1b608091e551708899bbf5b2ff90638120d3df021575d9aa5eb5cf48cb0b25ace3cda8cb42f19b25d2021e2e9cbe9f82ac36123355e5c05c3f4d3bd081f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000193b41fc3994284c941ced3de1b41156000000000200000000001066000000010000200000003ad664022b45d0deb8fe819a6fa8fb9a33c02c8dc6e7fd2b05a480287f376cd2000000000e8000000002000020000000dc01629acbd656ac477ab6cccf195d596da434405606cec7834df061e34e775d2000000054e5d687606f0fe3fee7bca8ee9db33b7634ee58a3469256d26617efc6bd163440000000ec1b12088d3265519b3700d573da3199d735e567fd3cb19fce65a3e6e3713b6af6b48ba3726be7f3174401b2649c28483799a0c23c47a4d4d596b7701377df1b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1AE2B4A1-8663-11EF-BCF9-7EBFE1D0DDB4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 0000dff06f1adb01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434656436"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2668	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2668	iexplore.exe
2668	iexplore.exe
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE
2684	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2684	2668	iexplore.exe	31
PID 2668 wrote to memory of 2684	2668	iexplore.exe	31
PID 2668 wrote to memory of 2684	2668	iexplore.exe	31
PID 2668 wrote to memory of 2684	2668	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\2c8138bef006092439107b3ab657b577_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2668 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a111a07c609ff80527de03ec69cf56fc

SHA1
dc02a6387120c20f52b8d7bdfe826bd812464e49

SHA256
82ea000631e31c3c3796019b02312959a84f59502c5728be593a9a4ee1396c92

SHA512
c151bec177f31ebf0ad4a8f05d51781dc7091d0314f0054f999b5b4940cd2ebbbbbfa11e0e82b470c0f4a3a046c1a00480e7fa753c2344111e5efd0e09b5e2e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0cbda8a983600b70b3af5b0ad2350ecb

SHA1
4472ef3ab3d3cdb28da150bb10d7da460a0d6d90

SHA256
efde926123e14406e78bc0d14504db1c59f5fb075e366d20cce4752d910b367b

SHA512
87d8971a57d9f0132e8a7030a641e3399624345e233e8a54bb1973fc14d1ece194f52b9cbf354cc4d99ed656a81cdbadb8bdcf263c131c5eb128203bf1aa25ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38e05d0076b7b1f67bdc36defaa8e6d2

SHA1
dadcbbf1b50f9433184f83a4702a724e224c7057

SHA256
21e941de25c2a8feb856c50220457450d654f67e8134b7f6360f8f1de753273a

SHA512
8226cebeb563e00e6d88c4b25fadd047cbfc203e92ca45a0307e05cea3c42f506951020adb2efd14149d9a75d6c53b4e3c5018b32db365f0b491ecc6432bd1cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f9d400d90a829c08786db6c157d81056

SHA1
87c9701ff04f7386f1b371829732fa23abafa63d

SHA256
569d97a0aad5ff703cd6afc96cd3b90f136b51325e1bde53f077feb6c54db5c2

SHA512
3596616f81551b0b7f6a4fbe4f9857695f814d41c77a1c99941534119ca91836561ae9a77f81203cd2cc15ca8a6ffb8a30edef6fac7a69131333832c5cb83757

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e1389ec818040b325acd3321060a9d2b

SHA1
db50a45b8a6c7e0fbc74746a3dd691b733b1dbac

SHA256
7f34e9d29936de5649cbc9f5c2cceb0f146f80a3bf8c224b4e2bdf7546ee4b05

SHA512
61ae47cabaf328df7d63e99bec9ef4fbf4bbc612deef17238cef71b264f27e3362e17341e1bc950e63dc5d88607630bbd0e672f6207d2cea6a65002c2b0357ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
88bf3343814229fc7c6323df8eb4367a

SHA1
de2db3bcaba2be6611f6d8629dcc4bf616dde7aa

SHA256
41eba15de43d36447aa5e1da015221b919ea1039aeb834bbc0ee85bb67db8e78

SHA512
9f91c6cf2ab2dfca6910153d269d2f0dc417e66258429fcea6477ff46ae594056e7acda36c3114664b43f08184b4f8720d66e3bdaf69893848410d7b35933e5e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57dc06432c9b50463610785082671826

SHA1
84784f65bd45888053a710b38ec528afc7c83819

SHA256
a3c0c6bef671e055b9e0fc7f353628073ee622bef0b239276a74e28faac93450

SHA512
a875c752488860ee410e373641af4ae7b07be08bb7352ef60decbb1e58165763d04a2268a4724d3c5ee47caefc96b93d971dcbda138e8236e50a463a7ff55d69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e8aa4c774db93d506edf2d7209769bb4

SHA1
1f25f078d620a91c4e53f813182e47114b24f735

SHA256
b7c833f01efd0b5c1a30ecdcecf42f82710c2d18651532046eae1d4c208c45c3

SHA512
2ebd297659c246615c431242e527cbcac35d81bb60b8fe3cb4c31dfe9cbcd09e156a0911b22851b253fc671f11bc3c1038d2073802622bd4794a05ca3aac2051

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
618650d0b0b7e0dc8ce0b3c52fe2c47a

SHA1
fb668e2dbb14c2c19281d9c5b2aaa00852de70e1

SHA256
757e61f3ce4afa5b991a69245fe8206b4d731979e59777903bbfa34158417739

SHA512
dcd0b65e7e9df37bd1cef8bae563669c494e38543a7f90cf7251efbd2eb96431b7b7dc87dd561588650ddddc8f0a92fb3b60dd2bbc434cd7b519326d5899f403

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aa91e20d05baf27a1f263d1a2fabd7c4

SHA1
fe8259804dc2730aa9fe9e6b943a2a05b3f8d4fe

SHA256
4d2a3f6086a89759b3fabf025de56fd5db7e26ac1d6f7d944c48229926612956

SHA512
28849581c49864f0aad125194b9b1e4a5f770a6e3f24abdf51e028d281fdaffeb8d68a1bdede6c2f8f1f48e1127180c7a29188c0c500a5b092230d4456a216ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6da6dfd89c66a6667ea9443ce06a9c93

SHA1
4c89a2774270e2fd53726957ef5f6340a5f9e9f9

SHA256
19c1b60ae0b0acbd84adc0a19d5fbf411161a30f565b241593679eb1b0e3d9e0

SHA512
77937e46b4bcd63cf11feb431a70752c3b6ee1c798877fddcf41b2bffbd7ccb318933a8cfd7e636479da13d7ae6f65ba61ae973c110475b80ba8ecb6c116ff21

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD9B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE49.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit