b7a6dcfe8fc123fe8737c07c244f44511ef13352c3124d524374ef775e78680d

Analysis

max time kernel
141s
max time network
142s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26/07/2024, 00:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

71da72b6a4f0d0eac3d8f1db69220bbe_JaffaCakes118.html
Size

35KB
MD5

71da72b6a4f0d0eac3d8f1db69220bbe
SHA1

c59eb02691a4bd4b51b55a19899982c81191f774
SHA256

b7a6dcfe8fc123fe8737c07c244f44511ef13352c3124d524374ef775e78680d
SHA512

e495335fd61940ca00090cc191d04c2a3c9cf1d5ca0fee2bc89ca64acea32b07e45f3574c2a070900dd9821d8d743bbcaef5efaa33adf485bcf5040e904fda48
SSDEEP

768:SvXXMifgtV+Z9E/OXni6LfdEnIv2Ze6+/6lJ6+/6e6zr6+/6+/6+/kikhcP/4DWw:SvXXMifgtV+Z9E/e8mzsK5llOcP/4DWw

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428114988"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9CAAE0D1-4AE4-11EF-82DA-D2C9064578DD} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000c755b3055e46f3f0bf4267f60f49f98b5c7acf708d3af515da837b1990d054f2000000000e800000000200002000000048d4d6906d3519392dbe455f40a5825704ef50d120ef8e7ab84c1357a7e6d771200000001f4c7cc839279ea0a6c626deaaeea945df2b6ecf3453acca2b97eac3b71a738e4000000074b9ca2b2c77393e0b3c377d3024f9e8c854502540534a171f53f776fcd3113586d391724494cf3c2fe7c2520ae2acc359778fe5085a907edbe035b35e4309e1	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000003e34b91f24cbeb977484f27a6bca2aefa29670b7d14dea50220b264199684812000000000e80000000020000200000001fc5178444b39950bc93a98369c1113be934b29fef17872c20c4827a0974350990000000d33db02c9aaa18ba60ba4713f4be9b6bf0398f8925b8a6669e12a31a90ca079b556b7bea09d928b49daf7813d1646710d0bc912e5b5cc4a1ecb4de3379f73de3e61024bd6b3f74e74bde7676f8fdeea39d6e730a1d284cae598dc2ea4193df607111ebfd81c2125027d220092a1775d58fe293ee38069b0e11f1fdbc3132e337346e5617e4acd2f1f655d65494be12af40000000150552ba8babebadd6e6371c24790b7f4d3b43f81ef807197085a7230ace85b7cdfa8ee7da22ae928ed4d21d2609942c3971f8241ec5808a0e4063814cfe0e18	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f05dc675f1deda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2948	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2948	iexplore.exe
2948	iexplore.exe
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE
2340	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 2340	2948	iexplore.exe	30
PID 2948 wrote to memory of 2340	2948	iexplore.exe	30
PID 2948 wrote to memory of 2340	2948	iexplore.exe	30
PID 2948 wrote to memory of 2340	2948	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\71da72b6a4f0d0eac3d8f1db69220bbe_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2948 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b7324d8afb9a91fb3bb3315a34cce10

SHA1
10e97386f35c02d8a0cacece6ea9c876dcf112b2

SHA256
1700eb02749dd886ee64674465447d28291278f3cdbefecc5bea78fd4ecefe53

SHA512
c47406ebbf9da8f64d34d4095df326bda3c596bcfe3e350d3f3ed7a37d65b0e59f84cdc447515ae3b16c41fbbd688977a9bdc1c61be96c3af26f0d407bc13cb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c204bbbf2e9a694eb3cb80a892e8101

SHA1
f959e608744f67fd4941a3cd0c988b73ed0fdf1d

SHA256
fa114688a41a0d184115f34bb31f4b43e95b88bc5e4759138d3fca5c01039b88

SHA512
dcc1e4f43d4fe34c3d500aa94929111ce78dfbeac9c1d4643a98b8f78047c0b092eb4053a45a618170ae992b39e147317743fd2095f2b9b67897b5b84df10604

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96cb8665f377fe6d2cf20876615de98e

SHA1
d3cde7dcd4008bf5986a209618b5f76fb351fc43

SHA256
c871cad71e4e6a4c1341c67ee5044ae9bb15f19d0e88e02011f41fde313551f7

SHA512
1f158d0bbdf6f1162a3bd41b2a4697f44d957a3aae790818e1809e9883a4d359e23f12ee2a9c65de05a53471e8e71e619691bd2832662f05f0b8c9f09420ec48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15eeba7eab5083800e2e6f945441a0a5

SHA1
1b168c1fb1106b0b607f1a7cc689c08b7fb35f14

SHA256
b89bbedaaf446876b358679217c8e431e7132c18499198eb753e3e6627aad987

SHA512
ec25be625a86d9c12d50c65ddbcfce800d0eb2c95e596d3b13fa3ac8eb8a85e4a6f3cc309c00c5afc394f5de2f3dc7f79a238f2c2da2179429640f47fa0c40be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4162ecac27cf73191a2d15dc399aa46b

SHA1
4ba76d3b5c20b42bdca6a24baafbc9683b6dea83

SHA256
4ab9e98f8de8b667dae1ccbfe521c3be9238b0b9f07bdbae9e2b124a53b8e6a7

SHA512
4fa00efe77565bd1ff15deb8dcd3979e87009eef0bfc995968eb28184d792c5a5ab99f4c8a385cb350e59ec7a5d6398d644fcbbe93262b1115923cce9ce53244

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fe8781c3274b8ba4f68e6c47cf70e999

SHA1
8ae81a560638bc3e87c76db778bc0253cae65898

SHA256
6947d15b6036f8ea69eb8890727eb47abc91e83bc762a0cae5995b2da239766d

SHA512
e9e3de50b0e79634c12fe3506b8837511fc3b7834140dbab2d3954181c9085efa33bda885f5dd1d8e628ca3afec66dee9280bcf12909ff2caaaa37c9b9c2f941

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66e0ea3a43969220d6ca2dadaaadd409

SHA1
129cdaac3f2f5e13501c78472cdfb19a06074556

SHA256
661bf60a13d381d1932d0d468f933ab74a1d18ae4f949c7cb7f7694f45198739

SHA512
0ec3501aab3e7742a1b706a86c0ef901466b502cd88d7dcf270a4f3e040ccb07bdd8328d69772b2a8502a1a051c1a2eab971811f007c8d27b2b0c5ad46c7f0d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
135192bc2f08de7a38f7ae0d98bd10b5

SHA1
5d77fc69504d4f3d250ce0b42eb2ea3ec0331261

SHA256
3e19a274fb1f2ba4fbb692dfd1ff250ca9203d2562cf6d05ed13cf8c223d3ccb

SHA512
153ab2e36096af0a1f27eade6cbbc02c71f56ca2e885be39d673d7d3c6d2a8880b42de0015d8a1c7db274b3e84b9dc3ba66f8120657eaff0ebc96eb812fb8680

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86495b19df4c18ab561b7932b5d9e34a

SHA1
f994808c3407756bb06c0b3cfe205738e63a3702

SHA256
9553099542739df014d1060f6f8004b3b42b1da712354b2c1979ac988d4bf312

SHA512
163f109d155c5796a061b242525f28b56f78328e09f5fe66c006ec3c075fbd0620faf288216458c9ce117f7d7127c32a409fe90a76312d1db6d6120231d536d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f6faf75ad187b0007c2964878c30fec2

SHA1
6ad229569a248f9f752a3d040308ec5f89b211cd

SHA256
3de87075fa894d145913977b95aecfeda1daff0966f72db179b7cffc4ff01c0b

SHA512
b7090172025f60b3f32d10a8fff9aa30af6b54874e25b9f11c25864e7404882a42216240c63f3045d657ce951d90dedb0dd19c26b8845c45116a09f5940170f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c40b183431fd4c5865424644c95f647

SHA1
bf8484cab8c5daa17df3c6e0b95ebdef3dd8702c

SHA256
fbcbe6d8b8fe059f71df33dda28d7d66e241f7871a7fe58ebc3c202f4b911c87

SHA512
4a10ec88e16a93764c4c925291f2435ff922b3db1dc33e152e7ab0402638cd956eaa0c0640a410eabf4592c7ee0c2022311ff7e197608a9ef49b3ecc1541ecde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7378b419b01fd58aeb5cdb37f0182949

SHA1
de77de23e76298437b865cfe9fa1f1dc0577cc71

SHA256
232c4334fcb71aaf6a84a0744a2bd678b0a05065351754151b456f31537d5b40

SHA512
1d3f78032e86a58ad8773860aabe8fd903eb3df26fe0cb800f580fd15377880de5a54556d3433e721a7b310fef75a3fd877f4f3f6b308fca2cefdd07aa8d7bce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59bc18de2d75c74f7f219dc42b97436b

SHA1
34c1ff4a88957c17d17a626d42ed042092ec206a

SHA256
c9a42febb1eac00912f49b231b4a08f11539597b5b3f59df995641ffb62f14ef

SHA512
e028aab051c78629e1009148e9788d87e480b2d43b2fa1f2cabb693fc113e31013330e1b5ad21ced9847051a4fbdf3cb6fa3ef1ba259ef71a9733dca2a441695

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83b2345e961932971cfb5aa7263bc805

SHA1
9142295ad4d9d74ada1be28dc2a3f49cf247749a

SHA256
b12572e37b9cb1e914c70969cfdff258cea3bf0518012393bdb9184dfdc0b099

SHA512
8d72669baccaf3321290e7c52165ec904eb931472e5a8e2f4866f105de665d89249b3323320fc492d1d0215d9f1d3678c21ecbaac8edb0045a0266bbe406f907

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC247.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC2B9.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit