b29e211910cf1177200a0ac374e71b261752b909a02cf894fd0200de0bd1250a

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-10-2024 19:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3672fd06b69dc8751314d48b988d333d_JaffaCakes118.html
Size

8KB
MD5

3672fd06b69dc8751314d48b988d333d
SHA1

7a4d951705940f0078093106cca03244722007e0
SHA256

b29e211910cf1177200a0ac374e71b261752b909a02cf894fd0200de0bd1250a
SHA512

d4e3da2f3dba22b4f766b2360dc55cc857147751feae4e2f7745331b268dc3c6dbc60e0104ae94da14ef7584465df98cfa7287a31bfb601ab454936b85e92ee4
SSDEEP

96:uzVs+ux7nKLLY1k9o84d12ef7CSTUjzfs895DrHVbfwCCfcEZ7ru7f:csz7nKAYS/Zb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea2200000000020000000000106600000001000020000000e4b8703d242e6b946dfaff6c77c4b4dca7ef1b34d4ce74f0b17a2b36e1c00743000000000e8000000002000020000000f782cbf06733a51246a331f2241df61490b087131d8059093400049923990cec20000000d953deb4fbc369a418326cb946a14e9894717baee0fc52131b37e73235745bd440000000ff6527658d4034f6bba5f4b1c9d59a72f99a4a0d7b96041a62d25e276d3ddfc072e306dc137c320fb5683eb676409b271eb5152c1e433db76f49cb11268602b4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f0b44d0a141cdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3388CA31-8807-11EF-A528-527E38F5B48B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000045c0dde48c11474f81d9a2c02be4ea22000000000200000000001066000000010000200000001d3209585a5be69da9fe6ffc881783eb9a6ae2f8c560d39bd0eb877109be2990000000000e8000000002000020000000ded4c4924326bc82af374fc6986cfc2aab127dec6bf01ce5b803229bfdacabde90000000add3f6b826f2c4dbdc3784f502c6b73946599522f3f75c2ed14896fb8e8d489ed4bdfc85592bfe018ed6a6b055faa24193b4507886666152f5e0bdbb5c677a6c208364b98a6721e19d79b94fb4e99548e1f40da6731b39d9b1c5a9402fbf0b9782c9643f4e696e7821acaa89fd76f0f3ec06bdfd0cd21d6d5f1fbb7c79c30a3f4ac6425ca25cba676d52e287c58b49384000000009c9e26779a14867e831f282a6f54a85b210f25737a27526af980015cc58a4a0c9afe18b610d22135d8ff26c19c8fd9a74bdcdc53852a793ba09b4119138c643	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434836865"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2096	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2096	iexplore.exe
2096	iexplore.exe
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE
2812	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2812	2096	iexplore.exe	30
PID 2096 wrote to memory of 2812	2096	iexplore.exe	30
PID 2096 wrote to memory of 2812	2096	iexplore.exe	30
PID 2096 wrote to memory of 2812	2096	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\3672fd06b69dc8751314d48b988d333d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2096
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2096 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d9d79b515abc24a341281147d056a95

SHA1
29820c95ee32c0d13166dae7a136628a4696406f

SHA256
4ce9bb023c487f3d16389dd9e6529bd6205186a4ce23eaa3e070b9a10948a171

SHA512
18e98b224323b8ba44972fb7ce0c5e16cbc192229cb0b91c0f84a4e968f49569f14c160837ded81a5f4b90127e11dd5f617ad8dd71949203f3c7746d1530a9d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23da07e097669fef574082afb52abbcd

SHA1
abe2976b556b21593fe1c2d7ad1af8863e6e6045

SHA256
dbf5106693fb4492b5137f6e69d354de984ea833d7058b8ec22bdd822754ac1a

SHA512
a0699f92bc1a3ff60ce43d888de5762401275cacc532785d7c3e6a9dfbfc0bee1fb5e6cec8c010f2099d5f0e2fffe80499e59de53cb8245e5a68531414763a16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c0ff1831c853e2f43be4b9980cf130cd

SHA1
05cd5cfa7513399cd470df9b532b65b3ef3ea229

SHA256
793511da38610615c23778b18c036644b30f54efe546c372d0352e40feeabeb2

SHA512
1654f95118fb6071441d8dfb712215170ecd41d3efea72b58d9213c5c1fbc062158d487dc0ea07bd3de4bbc1941e8a88d26171ea8557e8b59d80cb8cc4b01577

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3d1cbf783f5fff9a9afefd6a58ab104

SHA1
ca7f920705b81887a41ea49532bccdaf7d96b6a5

SHA256
7bbee0f455677cd33f321c115d9504b09da331833970cb61e3cefca07ab75db9

SHA512
4777944fb5557fa6fe3c7b94b646bd3dd6166deca15aa891db37dd6c8c74fe09f0ecc0604545db3d738c4e44730f75af77210f9dba37bb478e59f0bda52ee9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78da97de5f011d408e4421e16e27d8b9

SHA1
53f20f8d88ddc056ed07b9b119e58fe0b7a469d4

SHA256
de5cf70033793705acb915f4a71a6904e558675a2a0682ce552a04f3bd4c5b51

SHA512
d7b6f1503d47fbcec932e69312caa7a1f167587b5f1a11926c5ef9713fed4f1d84b76b8b89474f8262744cb52bd0ead91bc7b45d576a9109012b21f592771397

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a077f82295533d78d36bbe0022aecd2

SHA1
ff438f23c6488d74c27bd279e2198f0f71929d2a

SHA256
af9890e4dc590a769f4fb48cd94c4e3079bc4d72b825cc5770b2823efee3b901

SHA512
84c2f716412ce9cdf1f50b1436ebe9728023fe9142e6a9ede77ca96847d4584ed816478e369676a4db4860d9b53ad0d0a13d76597f0a54876fc1e8584906cbe0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
af686a0e5b909ab210c70312884e3a6e

SHA1
3b80f0ea0aa0c3f3436f0ead951199db57f0c4c5

SHA256
9c710e6011531f2017b1caa0d252984db927e1247825c119e023b7d60f7b3df8

SHA512
7db2f3b514fdc6a414c3e3712469c943c99f20dd7577f6ee54a84e59e86b8b1401f3795221352ea4d767edd105ebcda7d7fcf35513cd5aa101b8f4c3b0c44ac4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
716f98efd83a293aeacf33b748170be4

SHA1
af11a613eda9cb5bdeb030fccb277aaf5ce64c29

SHA256
991313d3725b338f2b0e45200126c4890d3c3482a58afa11b487302a037ab768

SHA512
8574133178971f41493d3172dca197f5da7dd91ee23f4f5faef7e46ac86f246a2c8b274d58eec492ba552da5bdebee047172cff4a776eb936888de4ceee0ad45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc22d01facb5a5155c820d312f151347

SHA1
ff06284f11ebc43ae7dfc978fa7b5517c1fe0919

SHA256
3030b8aec189fa83d12fd6bf015173776b82842364ee8be22f31d95237f71bb1

SHA512
bfdf5f02eb31c4ff3ea9d920e4778533886f4df2f0047aeff168351b6c4261accd8a219b7b5414da3128cf073973964fcb2773ae4859cf7447da5f4a5bc335f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e99795e428dcf9a1eee8eedb2fece48

SHA1
f824e62935af5ec12430989dc170adda2f213554

SHA256
83116cb9d6e7b357daac4a47ec4542303a1ab6ff141fe5b74990d6921f112f52

SHA512
0067066297e2512f0fa4b103489a2737cc40702ec128cd7f9f3cd095eae8d7deb20dfc75e55de2f296c45ebb2aad86fdf4a57b701d8715e14828c892888ff5b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d87c770afb6a0fa49870235f8ae3c01

SHA1
545c8e098eddcf8ee3f3b777bad632fa645b20bd

SHA256
8dde6497b1be36b1233df83e079db2e0e55fbd647ec8e8445d145e0670050ff7

SHA512
b1229d722b6e39c9581995473d9f8a9d3e3489f7f32e0037c156a3b67fac388ef7c919642ffe193a8a253c178cee8173973971b8940d5cd4993618c50d0d3d56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ec5fb94a1a0cdcb62f94a7b176d0640

SHA1
588341ac5187c09a830176ea9e04abadaba093b4

SHA256
7569f1bf52dc4334ad9afc4972ffd4c6e9116d837bad64e0fe84f8e356c7193b

SHA512
806b041e27f58db4c353cf14e44911bdebdde4ceb8c0abf781004df721b63b26ed027751bdcd96ab7a379317d7dbb08fdaf9a3529468c98cc28c084154e50e42

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab9A40.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar9AEE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit