c702138914e0b4b634d9aeb1394331c61e3bda1799b5a3d7edc9decc634fdcee

Analysis

max time kernel
145s
max time network
140s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25/07/2024, 20:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

711c24c93a1d6a2351ee390f98c6918e_JaffaCakes118.html
Size

95KB
MD5

711c24c93a1d6a2351ee390f98c6918e
SHA1

436b75d40c0679c95dc3fb0aa49d1c348b50ec2d
SHA256

c702138914e0b4b634d9aeb1394331c61e3bda1799b5a3d7edc9decc634fdcee
SHA512

f3b2cf0aa46ea8e8fb9afe8979c63d4db6a504ab08971d81c3d7935b53260ec97a986a14b09ac78ff5e0df4c35c463f043318806663994cd653524c26fd48373
SSDEEP

1536:gLqm4DqGq88r3UIErobSy3AYpqniDl/TT8ebsK+ByHNyDTPvLmLYlIhQ9F+0zv7N:Wqm4DqGq88r3UIErobSy3AYpqniDl/T6

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f046aa28d1deda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{5D84DAC1-4AC4-11EF-B0EB-7699BFC84B14} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000004ebcf1591afabbba09af202a30f305757dc46126815860ad44ada0087cd2263a000000000e80000000020000200000005d8ff9f49b15542dffb03bfc6dbc6e8c7021bcae91e2392271e0f0e69cbd80b72000000015213c38fb3e7ca5e7865723e7f5688a538e3ffbb85644a829e0a90394d39cfc40000000e74959c08da28ac7f50ea6d157cc607fc8052db75f6cf01187ac62365c81cc8207cf7a95aed88ffb59c5ab1b02f8b866213cee35f7afeefa65c512f0665a422c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000eb9592c293fdc9bc7df6c98ee13431d1f519f37393d0dfd15c87ef189391b70f000000000e8000000002000020000000a5f1f84fea45bbc4d653519f9c70b770f66dd2cd413e129671bbb8d627024aff90000000b868efb2c6beaa74651c701f55955107f8df472177119cc21dfba4e0880c7764b2941bcf3d11a511aae33da59b9e6834b18766d0ad94acabbfc780daa6a7084d819c4c345ca6179a7b3e5b1a6a5bb6b52c25f82945d543e479800598e7ddd58532ad67907b2f7bfbeaf007980092f96cb6af64717b1a514f34c99399650027f7494a759706d865c904e5983d7d54ec6840000000638fe8cb5383b759e80f5edd1eaa83ed5037587c6e7f7395f86cc4a455c39835c60a897d98ddbde0e4bbb52f6755df2a1a6e135ae5f6b6a9b20bd2c3b9f8bd1f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428101150"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2240	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2240	iexplore.exe
2240	iexplore.exe
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE
2524	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2524	2240	iexplore.exe	28
PID 2240 wrote to memory of 2524	2240	iexplore.exe	28
PID 2240 wrote to memory of 2524	2240	iexplore.exe	28
PID 2240 wrote to memory of 2524	2240	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\711c24c93a1d6a2351ee390f98c6918e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2240 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c13ed97286fa3188254f37c43edb25ef

SHA1
0bb9767099ab3a0758cdcc68bbea71521ef43aef

SHA256
ee1021b7f4b0a2286e9518f964b7933a91a3a684d7af4b1bf16d0f6e4671fb22

SHA512
fa1b1a803ed68764ebd4f8427a1c6fc7bb953186acc13afc67251508768a6eff7bc8be4045d485400caf65bf8ca44ea4009ef473aa33ec5938a662d79455c593

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52e0e103943e6b7983d9995f393583b9

SHA1
f3e0603135dcfd38f78bc939f537e18ec85e3d50

SHA256
f1b4c8e246eae2419bc5d50368a08957a70855c4e681e89ad015e23e0db03ba7

SHA512
d9a133746c4f932c5cafb0c14c30913690e14e9f1224f4848f3f6d40bc03afcdfd248cfff42d762961552b2500cb345b345732cf49b7b3026b2ca57c3ab2d2cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
095be73dc5a156c0af63cf63927fb947

SHA1
720ca8a5168f94f495e82609468bdcdb9d90107f

SHA256
41f3dbc35bec873a29f11dcb7a9af7d7e3b8e7908b7d85b9da19809f19d5d5d2

SHA512
9e2b7595be31f7a4e203608642ed7e974200353845ed5b42790adc9e9f1cc79804a25ba6ac6cc991e5cc305ccee51ae44578c30c9cd1f1b31350f265233f24ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6da3b19401b6c5a1d46dff88bb9842f8

SHA1
1afded44d6add9a8025e89b7d3397a54fa3a8bba

SHA256
24013d73852cc4f3f8c62566123edb898e9447c2c8b7764e264a6d2795f6d284

SHA512
587034b240ed23a570f76ace9b323ee0a273903eb8ff5f8d7df50c9e34e7d1ebc8868d77b7488b57a9f7015bd903e331232edb8c578552897c4d3a5ee040380d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
937962659dc13d650425ae1a65370ac4

SHA1
a435a0546a7f18b57a028aea5fe72939cf4d93a0

SHA256
b2c3afd33ee213b819c7bf91b6fd6f403e13e1e7cb60a6ee0003c1cff205de9f

SHA512
bf25c7fd78d35e39a64131b170a73def1dd5c51cd1ccf362bb31fbb87ed16a525162cd93146283f7491eaeb02af7060beeeb6d11db5f6287372423ab146ccf73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3531fa645724dde4d51f93e0ae4a944b

SHA1
5daf5382d0ca94c3f0b0b41c3811b00a1701c62c

SHA256
daf27bf295adacf739ed472df6452e215961a807c03e7806b2f7abff7f217f2a

SHA512
f5b85b954fa39375ecaff9d7d991157651d643404dfe537e34232ff259fff9701021f36538845648bb07ed33f469c9b5cd971832d830b9a1b7fbfe5a04d32ff0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
43f24a98eb1d9c7beacfe989f3fb2f04

SHA1
506bdcfa17112adfe45b672327552e127523b733

SHA256
f77f8298ef700b9b0dcf8cafd465d33457c2289916f744bd4735defaad9b08ff

SHA512
0c6cfa5e100eaf38473269eae677f33db3051af70c94e52c565cba352e3a073a52303575de4603a36ee67240fe7be4a5ee147a5c2dbcadee91ab13acae313439

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c178462a138bf66857c1738f9d23f015

SHA1
cc64cbfa10c4b4d8bd891692ac3b94c5f4342e3f

SHA256
65cc88d5329bb3d31ae43bcf232126de57eca3a5e44477ac8ac610411929de09

SHA512
53904c0acfb5e018cc704d1714f1cb1211c9e32e27e8e11e34ff7050476b5750e1d03a305bb8df02f0d59eeeb143a27ac3b9733b7f5d875710578821d187ceff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0596198c25c96eb9cf95ceb3399be076

SHA1
c3fe85a310fcd3fe15b9b7656686cd21d6a1c512

SHA256
8c2f9a0cdee1fd5b0bcccfe7aa54bbb0bb3f6ea0be6126d9207c27fadc657526

SHA512
09d52f915f8459698e7ce5bca891d1accc26ceaba100ea45448c17ebbc3fdadd14719ca750dc04b53ef8cdf9a3f4ad89c2568ec08ce3a85499d1315e03663f5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49bd18b58138cdb11bce273ca9b93043

SHA1
5db37e124d0d5fb0ebc7497d23bece252b2dc269

SHA256
cae5e6ba152f6f45de6a2f2352839375b0c2471d64025cee30bdf2a727d86abb

SHA512
f8141d9bb9485004de96fb01cd81a97567746bdb8e6e3aa53e2854ecccdf0d15f22fdab8a78902f5d4dfcbf20f7fcfa79c4d39dc52e2817dd516647d7a3cae59

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
27c381cd3f78201f79348613a1d94708

SHA1
bd9a45a60c800add381bbe5452f4ef767c5afb20

SHA256
391ff375dee8184701640daf45525b4ba2b3e7f1a82b24a4d12c66c6c0f704c2

SHA512
e0a53496fa6de9821a50e4e921ac580ae8d83079b0d8c8a1f01fd07476f857bc91ef0e9ca0feeb8877680c267b5c37688874a98e5f6df42e3cc7b0f67fa28727

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4fcb8f009d903da32d6954af0eb78637

SHA1
3185b7a524f742711532e60fdb6b300ecd6e0488

SHA256
397b246379887129c180e6ae1d109bad192dcbef91c36955b59e9b6c4f8fc0e7

SHA512
00f543dd54f07431da04eb8484a1b32c4a0323d0cee8ecc631cd648c115551b675e9839b985ada78aa7bf000b461cd70db3b59a68d7cf69df3f007a1bb6e5366

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCF42.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD224.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit