67f279238e0360f08a64953f5b57fa27a6705dd08d593fe9f1294747a00f96ab

Analysis

max time kernel
142s
max time network
144s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
31-10-2024 08:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8273d4af136beebbf449dfc26f1a7dd5_JaffaCakes118.html
Size

10KB
MD5

8273d4af136beebbf449dfc26f1a7dd5
SHA1

69180893360e446be429b45ee8aefd3a59fd1e18
SHA256

67f279238e0360f08a64953f5b57fa27a6705dd08d593fe9f1294747a00f96ab
SHA512

a7c75f1c28bd397fc2d589f6a847abad1afc09962ad2fbf4d452ca479ba1450704becacea1a80225a6b741c06db8740c91db6a60c920387aa2aeaefd191d8ce0
SSDEEP

192:4Mo4ItzQnn5KrORiRPGQKDcBo4SHQg2Wchpegqy6g+laYs:4MomqewVGV8pegqRg+hs

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a907cc1344750743988d8bab481dbfbf00000000020000000000106600000001000020000000bc25797aaa701a04933392360d879aa09b3c3ac6402fb4bfa36b881f1f7fc499000000000e8000000002000020000000b3f449df955a7d6e757c4a04e74ff78cc91ce51c33eb7f784fb08fc0584ad5f690000000b6b0427d9d913bc63767b4637451e5b176182cc3c0714d7c61284d37e3d0a2bab97109a7f7c33efbd42b4b586991175dc45dac46094980808d90b16fd82132d0aa7614c1ab843ff59cff0083e857057c007ee4659bccc4bc3c515ebcac4a41f3a0a360121c2f7443a9c30152793da322b3b390ec0223a88a633441be6619cf8be43fcc0a1b20a2aa0e42d6950d06da3340000000909e39548d1434f05c4e92bb58d9d115e83e4ed977050aedc7e20e7727d30902eeb7eff27ea9b9fbc71939dce009e499e6ecba2c210959af2998e1224fda0f9c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "436525894"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a00288b6702bdb01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a907cc1344750743988d8bab481dbfbf00000000020000000000106600000001000020000000b79351bee4d239800f1b4d9be4e86dddc71ae73abd0f1c5f195318c4d74c14fa000000000e8000000002000020000000278c9b0a95b8773dc7640db4b778814ba32669ff50b3dffc583d86b69257b4e120000000050b780469b91e40aee5a7d2901d5e1416e69bde2ae96458cc2a824a4ac2abdb4000000058fb0e8f5175f58e52a6c73d301975cdf7a2df0381923dbe8ba9257ef118216ec786625c4c0b1daec223267322b3b3673557f32888623c8e77b094cca84ca70b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C7547C31-9763-11EF-BB72-627BF89B6001} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2372	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2372	iexplore.exe
2372	iexplore.exe
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 2388	2372	iexplore.exe	30
PID 2372 wrote to memory of 2388	2372	iexplore.exe	30
PID 2372 wrote to memory of 2388	2372	iexplore.exe	30
PID 2372 wrote to memory of 2388	2372	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\8273d4af136beebbf449dfc26f1a7dd5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2372 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3d67478439d7685b23ef9997b9aa1dc

SHA1
259cbfece0d4d0bdd07478f1178381f3ff48dfa5

SHA256
779bf5e2a2c0769599ee4f1a88531822be215fb77f9599f885e0123233af5315

SHA512
6c832128fb4361eb7f45f288a8c6fb0291fb1a07070b66c6227033e95d8b1f7f7df2a199c4bdc0efff3b599498f606326850a91020761a45a1c80df4f5804e50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59e9c4437da137e6fb1c8487814f6818

SHA1
7b613fdc4ac2178d66d4a541c652d105f36a01a9

SHA256
cc75cda6fa38e497a180ba1578d5993ef0a9353aa4144a88c7415c8ff01efc07

SHA512
c2da8171e0686b28e8992e15c7b8b5e8f5ac29f3d8804354bd0445688e4393d5a189c6b6d9625f3f9f05c221f35b81119ba405461688f1a031cdf8efaa0eb573

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
757e074a078d1662c6800e4ca0081c66

SHA1
99afea67a10fd8a3cf9faed0719301c885b2622a

SHA256
c505b4f6881b256bd5e39543d504847eccead34524af37d242a2a0aaaf5ae90b

SHA512
6447a6d8817f3a5f1fb89a4d48ce26450824ce6d36f87815aab59a93d032939e4c59a5cf4874de60e228056acdc44ae58c7b02f12066e4c144f88598658372a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3672f9ff66c69799d089363c207ebf02

SHA1
13f8cc367300591462472fe2479eac2c9651625c

SHA256
6a31cbbdc45035995fbeac87838ee59987061ba8dec0222ee1f6bcc0e4a20610

SHA512
e18f25353381a91e473e89873b84f71744b34c1a19db84ea6988f2033c5b054e8707043282d6fae333e0cde008b6177d8900edfbeabac17376a386781107e637

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d0fade02b671aa6a7b4bac77f3fee7ee

SHA1
83e973b21076ade4af7e09e5cb17c96481221044

SHA256
12eba44fcfd97c50d80ac1c2a6b0f79e2ada4eeab5a1bf24e9ebb3c35697a2dc

SHA512
e9c1eed682a402a7b767362866d7a96a969c68ffe7fbaeac4d7914a1c4d34c7feb40fcc56e58adb2072648f25cb5a6cf271f6563d43ac4a615e3ea4775c3fc88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
884a5544b298ea66d219b14d83162107

SHA1
f46e700513ee899f3e5b8b9cf883e28a297353ac

SHA256
553213e69e52f469ea0ad62fa1d031ce348c84b5c742d420c727cf3bfe27e95a

SHA512
e59c55359b7e84e0b6413e16fc3817738cf8a62c2275fb508f0b7ca10f28c795d418efe695e8455b68abd75f7004da5ac4be5d7ca92bde88201eb3abd8bd300e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b85ad03c91c6ababe828407e51db99f

SHA1
5fe516f8d663352bd8e23e71678f7a94cb7da714

SHA256
d074f9ae6ccb9e406f313ddb84f7576d5bfd61070166d7c3ebfaf73db45c9f8c

SHA512
8b40c19e49accf4500c26422a097698d8edde919b8ea32eb355a006609737f07182e9a2610a3dd289d446e07e40e807fdfcad98f008db7ceddfdb9378668500f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f3134d891aa7481ee585a13f5fa61c0

SHA1
5994ab0bbd6c24bb15fef9f451b2dcb35c79a9e6

SHA256
dc774d23665917f2d757688ba59d4e34bdabd3e4b37464f1018b203f77b5df7a

SHA512
378e0572f66351f7232069139e9d5f015c56266740b9e6fa17253bc7dd0f0d44dcc09f05eb6cc962cb9f4844e8548be88ef9218f64d5daad25284b80f9dfe99b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e4e45d9388b50e6996fec7a5e5bffed1

SHA1
35139bb2d2e2b68ee2d07e19efab699446a75904

SHA256
654ad28b8cf2cb6092f27fea54f2847534ccac666689326c4502b2d4a8bbaba5

SHA512
b6d1990e434eee03a856f806d6816b6270b6fb1b880a50714876ff9e14aa1cab6f628271b387c1de52e2b0b9610a28f754389ff6c0e0e69da823daef2952b0ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66ae7202197e5fe27b54a8e98d5d15db

SHA1
a0c1d257e79510c4696bae0fcf54e8086d00ccbf

SHA256
f30729b366b900221bf1106b2af0b81ddc97069c87543b66ba526d46c12e75de

SHA512
080cc43d3aeeceb8546e3800bce25e1e554433837dc299b31d33241f395d75378558c9e03bf8dae7436fc432e37b1f9749063c549de853e40f432477130c3901

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8fd779ef579396dab2b6febc31e30987

SHA1
e2648b99cb0fa41bc23ed4a384d150c558af1ff6

SHA256
93443a31ef6db392ba6fd991ee0d80603ce13b250d6d42e135618d6ec53709e7

SHA512
dfb2be4deb8ab3d0842e41ec798f053b8082bbd70bccbd23e8e93285f4761d06650b2bcfd31a0f9330ac2cec3011374cbcf89cb6c73a9f12bd46889454d62f6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6855.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar68F6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit