8f0718e394862260c0da788592fb0c0250fd7826f3ed3593da14c0b1140f108f

Analysis

max time kernel
133s
max time network
128s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
10/10/2024, 17:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31101809536644a816e801fd7fc4209c_JaffaCakes118.html
Size

14KB
MD5

31101809536644a816e801fd7fc4209c
SHA1

fadc9b7656c7ed498e010a235de597a05b35d6aa
SHA256

8f0718e394862260c0da788592fb0c0250fd7826f3ed3593da14c0b1140f108f
SHA512

fbb4393a842ca918eaf24e04ceeae77333e7ecef9856a0773ac0df39b48d301fc9ab802647e3f3ceada2a7fab4bd29cc00a8b06cc47ba081ceeb9f35f44e0214
SSDEEP

384:aqQmnkKRHeERJBTMNKO22MjqNO5NjioiSi73ioijLvvJG06:OmnkWeERJBTMNKj2PNYNjiR3io4LvhGN

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30381c18391bdb01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{425F2851-872C-11EF-8AE7-D6CBE06212A9} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434742831"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000020a7c8da5a7e8741a9e6ea6b12fbc5fe000000000200000000001066000000010000200000008d2bac2921a135ee60b2c3e6d8ecd7f172e921af641816e1cbf3504a7ce495f1000000000e8000000002000020000000f66ebce223efa8a6d9739ff2358257a1d82776a865ef5682ae407986a363cd59200000001d39c0b9215a1f6de5672cc77ff7b4ba43419b960bb6de4ad1a27f2f3989538440000000a5e87f6372ab771b04cc5eb3c6c11c5109f765ba777cdbc73b8974a71716bccad199abff962725ee57773a92d5877adfabab59bdb6b785292d7382d00c97d5e7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000020a7c8da5a7e8741a9e6ea6b12fbc5fe00000000020000000000106600000001000020000000feac75b15faeda3b93954b01ca86c2c4d1744b9cb10107541170bbd9e2a312dd000000000e80000000020000200000000c537771d7488e423f77605fa7d77ac27e70d4b4cd5b34d48c3b514df19210ad90000000581e3b1527402603940bfcd7533e7c26c3b0eeb8dc533d63534dc9c91fc3b82e3a0afddfc89cf8ebfb8c4fde7aaef5817065039d992734e87d49733fa56ae217ba74af1043a04490a3d341b4b5e4e2e69364fc3f436fd1ce9e4ec4009296c0f4f066a6cc14948882f7b4b4e3972c8366af3d5c3cc78f1569711c4195e5a7b0c4ea7b78ac3ea3e6d9200c24e6a1bf5780400000008ae71a755b03d54655fcbc44dcc7b6467bcf8550b72b937f468d0b3f6b9c0f58dee17e2ef286c77b6117ce3237ff0781474f454ba1f3721e8439a8293577093e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2644	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2644	iexplore.exe
2644	iexplore.exe
2756	IEXPLORE.EXE
2756	IEXPLORE.EXE
2756	IEXPLORE.EXE
2756	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2756	2644	iexplore.exe	30
PID 2644 wrote to memory of 2756	2644	iexplore.exe	30
PID 2644 wrote to memory of 2756	2644	iexplore.exe	30
PID 2644 wrote to memory of 2756	2644	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\31101809536644a816e801fd7fc4209c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2644 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
25501a6df74cb8f7b8a0fe6959769ba2

SHA1
0bd9b38dee62c1844b591f10dae4c0bb29a8d30a

SHA256
ce8c86b72874c5166eeddf00f9a9f13fcb8407bff85b4c041a352eeff6216b73

SHA512
d26bc2073ee8898bf6a8715ea7307661c43506a27deb1bf57327092e17ec3b9b9004c3896b70108c08f57d0862fccf9afed1f29e4ab01c86cf8663be26f703a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64816ee2cbd6221b1afbbab93a91510f

SHA1
a57b18bc45b4829878d4eb20cd2ff9b3e96583a6

SHA256
8a237f350f58ba6883bc13bcb052061d5a60180d2ad209fe317b0ebac41d2df9

SHA512
c4acdf2e6c84eb2d3c23a40d1f0d5a0c4e77281abb480b153dc02b04b8ab5ba1a88f9cd55a3e857ba53c7891d074e313c7d98e3655f9b2864441d27e8ce15a1e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b1e3ae217b493429fd33d4e3f3a5f80c

SHA1
8f7f648b670c3f2d755380fc594baa10b1ef87e3

SHA256
36742bee74f3f5b4bf1b10ff6e1de58767fec7e6558b4d89e3bde56fa5db44d3

SHA512
99584edf68549618b59d6334af4298efabde64cea9cb2fb7fff4bee87daa280faf54e7e70000dff5ce84cc303dae9dc8714a27951a93603a7c784e0ce643a070

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
364cf32a363610fa6348ec5a649d04a6

SHA1
b977fd05e6917c6a151b9f99c101da2f490ed28e

SHA256
a4e23d7de52718416edb5a3550a25e70f3e262366632c41f7fc8ea48ae2b6626

SHA512
9442399b6699eafeebaa865d6d862ba73edcd4370ce5334a050f5bc72a49f865ef2483352d924fc2d0bb45246c37f78fe1bacb36acf58cf0d77af62ec40d3696

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8372a0f6a54c822ecb794216467332d2

SHA1
83818832c57a05e9d167b95724d0fad49c0c935f

SHA256
cc861ae1e77824b3f69ff5118e4a04ef0506524cbb8204aedb3dc9f3af510026

SHA512
0df3987bb45a04b2dc45f0d7d9e526e0549d017574e640b66d64e1c05003e1a445114e021854136cbf1a3a41c29b2f19de8107bc91f4b43503681a44a5728528

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
abc4cabb3ee6d8dadb55d47e81dd6296

SHA1
66938ae3adea3655256839ed47a0d3c40e3a3a92

SHA256
cec54578879dbc31ecc28b3cf52b756f2b4648a222f4a081f401c7f30bdb8b4f

SHA512
39e4fad5f024718215f7b35cecba871f0a607a315c2ad438f538fc8af0993138dac4de42903e7dd4ad63421b5a70ad0c30f9c81d3ec27849b888a0d4d24e305d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ba28285a23bc226f9209f6e11576102

SHA1
d51c208c917f84f07172ed89fb7e4f1a6ef2051f

SHA256
cec9f3d35d0744b4e46a0bc2bed460e6675e2152f889347549cba243b0492ce2

SHA512
465c06743fd14dcc5cc0dde04f42491a0f397e43d2a5895a5f3d45b6259cb4d43323a3df46120bd8b4105008b55e28cfb084c991548edefbb38174fc95f5f490

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d58058cbd420bc401f3ba059e12dea5a

SHA1
13df6eaa72b3a800228d8cbcd3195d30f5400e53

SHA256
f9ea8dd17b2d0f334ad8ebf14f6d409c26f93cf71d0061aafdd27d399a62abff

SHA512
bb0294db34986b12cf4cee2939f27690bb8051fc836148191c85d6ea637977dbe578a7a6872982e1006dc7a589b27825f5af5e61e2b3b656a6492c1d7fd429de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d35795cc9cbee4006f0fdea84bea9af1

SHA1
9a186fe56f2b6837d2b9dbb9ed0ad9d67a3d8892

SHA256
5636ad21077043bf8259b1ec0cb6be4bc966291fd53e7ae31e822810c26b51a4

SHA512
feb017acd0dc0d623f5c2046520ec1a28736f65a9e204740112fee3f4516d91cb29208b71b9bcac5fbd0fa1b27419f31351a47765a4acf9d9b4792a9eacecf69

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf8ed23a2b864150dfc8e39d493c5323

SHA1
66fe0c17423a927c640087b4da06a7ac58a8a157

SHA256
9ad19dafb3d7ddf03e50ef3bc76f707a793157b6f1906533ed41d760d790b211

SHA512
fb8852d591fdc2268ea4e69af7a2e2bd7f0716194ba93eec4d51057c5e639189f16f99123a1418ae6dfc37b6d39bfea3fc2eeb3d663cccb0a3f307d008e7cafa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a00a4b136a88528f8d551d794e46398a

SHA1
a508cfb583ef9cb59df635a55ac1147aeb0e4fa0

SHA256
60940f0440947a96fe1b9a7c4c3746b2503697f6ad46d4979d35dc8e8cf817f0

SHA512
9032d78e3d9d1330d48a81ea7f901503b16aeaccea8490929d15517cb081c116f424c435a227d1446014773f39eba8eb6a02970a4930b2272ac07c279fcb6b5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32e7d326905fed227a0bdbe9b095eaf5

SHA1
124e0054c8e920cdf90ca20bcb5b453b0e5e4818

SHA256
288fb08ecfede5a8f919a7b079de0dfaf438256ffae2ed0e63fa1b88ab6052d4

SHA512
a985d63c09ce6760714f8ca9767123c6fdc7fca51fb51e8c0c4663635d04bb858f500b973e5047bc83175120ddb0c18a2162bd3a979436cdf2b054c896ecdd6e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6676adc0a34ac4787fcd65536636a1e3

SHA1
769ab3e0444f235289f77d05fbf573c1453a7612

SHA256
1d7b171921cbfccd9b075fcac1e55ac73f996a1e27eaa22c75190628dfaaa925

SHA512
9a7e8669f977c76afd7e8e08e782e2948ade59edfb0ba586169b5b8d7e0489e56739b23ae835c7ee0197afba9480327a1833ab09c6468135f6af02af4e7feee4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2B19.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2BD7.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit