566f8fef76e3da89e95f05b6caa6b4dd4f4cfea617287fe84ed1403020932ceb

Analysis

max time kernel
144s
max time network
151s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
23/07/2024, 20:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68d23763f9b85133b6063a94168845b2_JaffaCakes118.html
Size

192KB
MD5

68d23763f9b85133b6063a94168845b2
SHA1

64a1f240ce07b7b3a9d4ee1745979a1b0760deb8
SHA256

566f8fef76e3da89e95f05b6caa6b4dd4f4cfea617287fe84ed1403020932ceb
SHA512

945eca16cfb016164dd292d155b3f6171586f51d0439eb4ea2392ae29cfcf019b0990f4069266713bc63bb09d505c54d7c625683a2a8c0f7462f508a940c1e2a
SSDEEP

3072:Lb7lysA8RdOQJBzAcajCWvzowcXmNRSUrLAK7WgAjRvzWzT6EXZWj6JHmNJR6xFt:Lbq8RdOQJBAcajfqXmNRfu8

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{91191011-4932-11EF-A251-667598992E52} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "427928573"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2776	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2776	iexplore.exe
2776	iexplore.exe
2228	IEXPLORE.EXE
2228	IEXPLORE.EXE
2228	IEXPLORE.EXE
2228	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2228	2776	iexplore.exe	30
PID 2776 wrote to memory of 2228	2776	iexplore.exe	30
PID 2776 wrote to memory of 2228	2776	iexplore.exe	30
PID 2776 wrote to memory of 2228	2776	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\68d23763f9b85133b6063a94168845b2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2776 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
7da8769e21adff5bbb2351832cd6aa7a

SHA1
2332ad2002485d56b176ae96f3f7ac79ffccfb08

SHA256
59337c10a1d7d5bfd56481a7089628f18823bea92a826e9860153145ee34b11d

SHA512
aba111f03da1610ee2f8deba1e0b69b3ceded7e26b889db7caf08e98ac21fd83e2deafdacf18967a9cb2925ded3f1ff1479a2b4dc36debdb3e54b9028247401b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ba33004c1d3ea1233c0c253570240e5

SHA1
199f674907936b50545361e0fd72ee35e135de3e

SHA256
632624d59c337e39c6d58c654173df19c287ccdb34075643d6d2936fb211002c

SHA512
d6b4f265ca5be0ad62d051f509ead85df822635aa5e04157ab4cb458db043e173eb7c3f37f255d7683a3567a6e3f72f10f694e7de54ab9d825a743db407dad06

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
874456beed11c875629bdf8821e4f9f8

SHA1
2312c015fcb343a5168297a3ed3c18150204e90a

SHA256
04b63fdb5738cae4fb3276522573234b10937895df4c781259dddceead18052c

SHA512
dc6af5de6542691082dff18a7775c65bfb82db91e2c1d259fc76893fbcf33d6b71a340fcc2860af4a4ad0f3dcec5d24631381889b05257fd07f5f256698ebe9f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2d60ee10c9ad724387dc0b8b21b463e

SHA1
d8baf5614764f70ca8bfe33a5d0f5e3f5011762d

SHA256
871945b9e443d8b7985176cb9c38f7bafd46d593c5bd02875ccf906c13dead48

SHA512
e16bbd4a9b4a99d3e7a37efe1b1857a8c1288a0164da00606693be122c0f0aba496cf01e10e9f82b564412e9ccfca30cfd20545c3594bb8c61f43aefde95b49b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
249acb4822d63076d775d5854a678a2a

SHA1
fb03987af10ba30f899e9183d677dcceec121216

SHA256
6a68022cff981eab0a41a84821900119329ad0183265287a28d541091aa980de

SHA512
9b1c6495e50b9b7727eb4b120847643edb8f3dfc700c50cba5eb6b8eb769e6e3b3929b1a798b248de26229afb3898bfbf66eeb340209eb0d6bd96cda610a3aa7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
660a8343eb3fecc3b90c0652911d46ed

SHA1
7b1105b2e039d4aea613e9ae04c4a6ea52e4bc86

SHA256
6aac7a46265550684fe524ef5b7587c7213ae6825edb5620f594056ef1949950

SHA512
937dfb61211a954638b682a7be03df3702de0387a5c8ae393c325d6c25e7db828ba3ad1b32f714cc467e6dbd40c87c35d4eeee2f4a4d52f8ff0208a097ebc8c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31e8a658bbf0867b9ed32a310ed377f9

SHA1
a727d2f1528f0e67d014311f8c5ca2c63374fe96

SHA256
9540afda36530fcfff42aee64954a2ae7e227bcd09b8d6117d03d24a2dc312db

SHA512
6fd8901e55307358d85819624d39a67be8253101f3d6eac326a0b2d82a251f68ef8131cafcba979e71374f3bac0f7dfea3b929e4ef26b81ea4260faf45b1bc6b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c347deba880514c44d013bf17ece5b75

SHA1
b9bb4bb52b689a58e467f1d6d616ff391724dcfb

SHA256
f146340c9d889dc7fa82053496b498d73b29ee11a93cfd2af08303b820fe730f

SHA512
1729dccba37d780651ad9114a3ec87cbe97e075fc786a8d0b3f42060fbb1dbae709254a1ece20fd31a72fdb8eb9b92674e1a369c19c8df9d1f93528536719d93

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
72bfdfe30aace957b324cc0622ab5cb2

SHA1
2e591556e82866b15a4e84e11c0cf6599698beef

SHA256
91203b9934c34be4978be6c9e42af682b3d84471c93138b13623abd4f9f2f01f

SHA512
9459f7417b3eef855698a0debc9b8430c17db1ee107c56415e6919b6c3878341a618d73b849ab7aaef258e0397175def5cd69e1accccd52eab2625159e40fef2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e35c190d4c35af19f0d0d7021c43b7c3

SHA1
121cf17f310a102f5910058daa7b6a2def8a3651

SHA256
f3f3db5c99fb898ad06e5faebfb6d252789f71907a69de50b101e3cc7c7c7e27

SHA512
e1d053ed1173735cf75da40e31c09db1f212eb18bd438277bc7476c261b07d350fa3a10d891f2e616ad0bf9c208d43a729ec57fffaf876ba7cef910f7c1f803c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NFAY0EOS\plusone[1].js

Filesize
55KB

MD5
15a42f20a492648f7c1595ea6bc99244

SHA1
50f3505e5459985af041ec26a6b412cfc2dc1cb5

SHA256
03998e7490f0e8f7d8490dc68ee8020101ddb4e8418567dbaa93426d15b721cb

SHA512
e5f256c59f1d22526b3610789a178ad06a2cab4a9c6c4238f72f67bd49c416540d5af74bc651c39ed2ec2558d1391ef77c30e68f9de73d0d07f34f5fe234af55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VOGNAB2O\jquery.min[1].js

Filesize
91KB

MD5
ddb84c1587287b2df08966081ef063bf

SHA1
9eb9ac595e9b5544e2dc79fff7cd2d0b4b5ef71f

SHA256
88171413fc76dda23ab32baa17b11e4fff89141c633ece737852445f1ba6c1bd

SHA512
0640605a22f437f10521b2d96064e06e4b0a1b96d2e8fb709d6bd593781c72ff8a86d2bfe3090bc4244687e91e94a897c7b132e237d369b2e0dc01083c2ec434

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBC0F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBC31.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit