a2491515f2d1c02203984ed69c4bf6b8708864bf43c3e559a521123bea5cee73

Analysis

max time kernel
134s
max time network
130s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
26-07-2024 05:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

72d56f12d1aac89b3aecc11c15469c46_JaffaCakes118.html
Size

9KB
MD5

72d56f12d1aac89b3aecc11c15469c46
SHA1

d17cebcfd032c2d9eab793020207c2d2bbace6f4
SHA256

a2491515f2d1c02203984ed69c4bf6b8708864bf43c3e559a521123bea5cee73
SHA512

de0f9115217788b92cad9df82c0c1902f37e495f889166a29608d8ab6554d2751e5048422dafc55e6bd2539b5837c412a49e848ea02cbe7494055c89ce43b943
SSDEEP

96:uzVs+ux7qOLLY1k9o84d12ef7CSTUzGT/knIDpebEJJ+MlVHcEZ7ru7f:csz7qOAYS/mIVg0JrPHb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d99090000000002000000000010660000000100002000000034db213233b605c3b5ec000f8ec9497af2e6f976e5b0bf32c128596c679d46e6000000000e800000000200002000000041232dc45c2dd19859dee66817affada0eef02ae6e4f21c96bea3e94121c3c3b200000006e28d70872c9e93a646a4c9e6df1274dc87a8dfe3ad14ac61aeef04e23a5461c40000000f123800060ed0e1a2e6c698bba4cba2a7f20ef216fd48441a6ba63c4bfa2dba775735bb43874e7a3f89e218056f7d57534b65183147d39dcc962b53d69ac763f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FA0A94D1-4B13-11EF-BDF0-66D8C57E4E43} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d99090000000002000000000010660000000100002000000027c3ee0d553e679e6e623337ce227e1188389ab85a94d7baeec6795608b93c07000000000e8000000002000020000000b68927fbcc9985a98956712742997772abf166526a94fab066f2b6434c88807b90000000e63059c328a9067887bb914d03106dc5a72ca3d6acda909e64fc161b52ff42e96807b9994b0be3dded8b6c7a81bc2ef833321c22104bf9f99bb08c932d07d58bec2ac93e5976482354cad63c13281042c75de60cee0ab7dbefb5293096d967c0ba18764590efd4aaaa38477bac4b1c80ca627e69fb86ca999cbd2ea90f6eda834b7bee46e6dab8fbc8cc82e6b6b65ff640000000c52282b69b7f49e0d9253b9277c22a218fe2a47355afac44b77b5d5a349fe87a8f744faf0a377c4dfd03d18a88b305bd768fe679d732e987aa3514fbd1a7bcbb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 400c9ecf20dfda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428135332"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2720	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2720	iexplore.exe
2720	iexplore.exe
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2800	2720	iexplore.exe	30
PID 2720 wrote to memory of 2800	2720	iexplore.exe	30
PID 2720 wrote to memory of 2800	2720	iexplore.exe	30
PID 2720 wrote to memory of 2800	2720	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\72d56f12d1aac89b3aecc11c15469c46_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2720 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e32d5ca8a888164231db9f8613deaabd

SHA1
9f6c52242285aefc75f318563d0eaafc6a8318f1

SHA256
be796a85998edb3c144e2d0f80c1b04311890afc60d085c3996aa8ca085b9d62

SHA512
0a110377a26ffa30c5f5e5484aa40938e7871bd8478943129e3cf0d9ca5747243f50378b5ebf2360656c619d2c5c4f5ba591ea14c72cf3987e9e8bba49af33f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
09b59f1ab420bce000ea76423c5360a7

SHA1
22423fd755216a0b539712498346d4d945dad2ac

SHA256
db1cb517243f663a30b03ee03fa8dd2d43fbd38adcda2bc806ba668ba7c021f7

SHA512
04d0a2eaa3b29a9456ebccf2109dc107681ba23ed080ae496b54ac67546a3094d12865056f346b39c310ef92578470038fbf5077d099d22c9fcd9018481b46aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
82deb60411f0ed0cd5d9cc07ffc4795b

SHA1
59199b2309f947158a035e7a6d691612221b60c3

SHA256
117d9b813b1a8ac6ec5cbef766d510edb28932ee09400127209f41f7b64e2655

SHA512
e91d68c5368c56fad467f8e9d5193090bcb17cee52019a7201376a579faf12d746f9435bfa3a9a7f677374d83460d482bc89d723f16e12ab872b8d5de5b3dfd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a093ea60fe344af4ba4f6c0d4a47030

SHA1
9976673cc0e6179e0d84e7b442765e3d208c8ff0

SHA256
c0e69b1df0e5baaa622df498205a18cb6d42d72371b272cc3eb898738dcbadb7

SHA512
5fa2f0a39660dd04cb99718e89250678c5a28c4a04abbfba6ef023760da28d4f4be83039e7afab4ddfddfc9017fb4992524bae6aa8eaef9a7d3cab0dafb12bee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf33ffbcc810aed2adba9254fab54eec

SHA1
95b196f64e315be86d633b86e298e9913cc7dc2a

SHA256
f612f75407099d15879c24317168a36862938a954794084598a4a792b4fef3c1

SHA512
29934a0cc5d615ae38dbd1da94056004f7102584c8308bfdbfd8978fed25335d6c420a36e89d751a98bf225bbb00e0ff37bb103e8d09c1d94b882846b0b8bdd0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ccd9889cf95f928d5a1a252b10016c7a

SHA1
4ec7728863cea9b19721135bcdac1359d8dcc70a

SHA256
108450964a3b377f55847129335878972e16b0c56ce3f28c799ffcafa8f610be

SHA512
8ff289797735cfd6e6efeaf09b97c417e2d62498f2e43b5d8bdf78683120188b573e268b27ec145e33ecd4fc20ae62ce7aff40664924619ccb6f2e9f7b95491e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
091d73b9f4d691fd818ea77b5627105f

SHA1
8382ad18087ae819827cbd2aed2fe08db4633db0

SHA256
3851f2970f507de8c4205047df229197ae282c90538e32d27834ec3ab8ac2a83

SHA512
80e028adb3b58b5f50ead41006ca6c92d013ed93a337a51520ec5b97b702163c569643b0f0d15226abdb380dccda399fdd227ef67e61511c7f0ff35e44e513f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc61e68f792a5e2c271bfcefc9248e21

SHA1
5bf3df2299eebe0b763ca22bd1948ced072e2397

SHA256
ed063e032f382df448c8b067a7a9d122cca4d6b2901c42c89fead2a487c32d04

SHA512
b3d8c38172b8255f59ea7d15321dace13538397cbfbfb2599164f5bf83ada5dc04196f1ae9292469b701b27bc9e67f9228c5f381b37807f46a288ed6592579e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2d0555120d71c68150295ba8644534b1

SHA1
2fcc9f333d60b56a3249ed1c8bc3c6d9786bc5e9

SHA256
9845bad1f358940aedc5a569eee1b56bcc78184219c305b0795e7ddbd6928d2e

SHA512
4e8e47982cea0124e9cf506faf711ee6aa0424e985266a85d168b3850d98c33e6b1f0f0439a1c3c19d2480e47411ab752d4e23e6fd3812b41c461a3be9fe2b5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fca79bbef2e99df458ff2832dc570d0d

SHA1
0bcfd900c7458c1daa5a219512a62e5ec3f418e6

SHA256
63cd8cf045e42910049a1472fef7d1f5b45045475af05b5990070ddc7be939b1

SHA512
fa0ab50f4e23aaddf20c895db57f3ba10988257d1b51c7c85eaef5f91b0aef8e58a755da9f384a7c8f7b8189220912ec66d6c4a035d8e066fa43ce1bb2dfb655

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
63d5153b304acaad3f0347182c91235b

SHA1
4c74186ffe6e9f527697e0c19b67c8697519255c

SHA256
738f8af58e5205b538d86eed0d922fa5fdbd53252cfb03db68e78ba9d21d4c20

SHA512
4efa4a8788bb509c4671006ed8c700e29a172ed47e853683dd2be9e120ad84887d6d40c0c04ef787f9cf3ce97481d2b2d976f0df979dacc20fede6823646c210

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96237fe4cb20d0d89cc67e443f7e8606

SHA1
15ade70e1a1595d99c6d23ea591f785eecf349e7

SHA256
b1d6d7a02ba8e76637ff2bc8b493147c8df51d0640abf6ee270710bd2922add4

SHA512
68ad2f8fd4400692b17054b97bf127e7ee346d3c17788c2a07a6c2459e87caf9088650370ec622c2922182a1eaed20667b845cc43f5f65c8eda5f3914811e2fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8440.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8453.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit