4707f0e78fb624cef28622b9144bdd3721b8f24626a0065792aae7054316ab0f

Analysis

max time kernel
142s
max time network
148s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 00:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7673b44b997b8d925cbe1245d7507e42_JaffaCakes118.html
Size

20KB
MD5

7673b44b997b8d925cbe1245d7507e42
SHA1

7b6b6d63610fc1ee0e03e04bbd61521f92b3b2a5
SHA256

4707f0e78fb624cef28622b9144bdd3721b8f24626a0065792aae7054316ab0f
SHA512

01c1b9d4bb1cfa1cae4beaa3d30d5475b46dda57d8063921f8532699f49bc6fc0a919e97072ca8853cc0f8beeb8fdcd36daa7d3383f13fdcffb46509f3bc4ae4
SSDEEP

192:xyvR5D5btY8wNrSn/iEUKVFTe7/Um1/k24qPLJmaO0AQoYpMFuIgJO:xQZt/QKUUsPPP7bATaI0O

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000c578fc5817bd1171df02e2a02e759ae2b8a108d1f84d518a84eb1c31af24d86d000000000e8000000002000020000000e97ae6d201b64a207e0695ee81eb5dd3c23137539af97312caee6711c0c0067d90000000b931315e241dbed0d285a9e1abb0aa6baab9f1d5b1dab6e08ee47ee3fb1143165c93f29a80ad3ceb1a485da4ce91f9324d37c98ce14f542624ab05e9d30b8bf64b5bb3499558fb05e5f678cab777a8ff7e698921c62be662013485e5580ad313ff2ee7e8a7b1c2067673e63ff364cf12cdc934033092b46ad445c1236a66d715d781a9df20f6cc225be2d7f0ae55a46d40000000b00ca36d94dc45fa0c4577606805ae65e017b9db16c6a2e224fa4c6ed6cfb26ac02b319edada929b6c24776fd26f3613715988574300935bd22366708be2e394	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{736B1F31-4CC1-11EF-9629-7667FF076EE4} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428319791"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e02fbb49cee0da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000003e63c386532bce9ca415d42277ed7fa5573cecfbe8b6ef228823539b72fe9e76000000000e8000000002000020000000fccc0571e543d8c595b31b19f7c04f2e7330f7cfd2902dcce66c958f9dc2107920000000ad29626f5162a1fc62c388035b7ea72794f7a00631ec2668015977a69ffbf72940000000e49b3abbba475f5474ca7fdc2d1e5674e647b8b84abebd0e120b3bdc934d66a922c04cdf7c94731f4098197665ad15f516002069a54fc4ba91bbff5601d4b8b6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2220	iexplore.exe
2220	iexplore.exe
1692	IEXPLORE.EXE
1692	IEXPLORE.EXE
1692	IEXPLORE.EXE
1692	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 1692	2220	iexplore.exe	30
PID 2220 wrote to memory of 1692	2220	iexplore.exe	30
PID 2220 wrote to memory of 1692	2220	iexplore.exe	30
PID 2220 wrote to memory of 1692	2220	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\7673b44b997b8d925cbe1245d7507e42_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3341d0af4a284b7318c4d73173acfd76

SHA1
a45bfc6bd5de0e7f241440ff0661f6fa0f97cc4a

SHA256
c7811b981f8ad17ec75bde252a50c0c2a4a647ca0120834fdc7b5c88470db00c

SHA512
421cd239293f95fe54558aa77055dddc2a5b108a19c2b4540e8f15c41744ef6883157bdca6085920ddab9e0f6770e72216de6b6cb3b0c0ef9aefa75909ce892b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
48d34237f1c7f9ac52fff66392206bd0

SHA1
ce0880d1237c0f63d509deceec7a2554c741756f

SHA256
0a692d3bb38fb4aaaf90098b78da1df009615aac8a54ea38fc35adb0acf978c9

SHA512
1d32e55062d672bddd1b1ff078ada911eaf3ff732f213f0df6918742701975ca20693300f37806993fa15c8b997cb9552484c8a69dec2b4b4643ba0667a9bb34

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce2e5890be325de21e4828a535a260ff

SHA1
05ae0e208c8d9db7a952f0c3861e221b49e84c09

SHA256
ca822e70315e37c0363330ec0fac8f8efb0c4db2078b5fb64077e09a9c82ebf1

SHA512
df80e046e890370fed61f7ce73290652f8820f93a50348dbef91412bb2ca015598008331aa5baa8492bd10874e319dda37e2776e203580b9d913af360bf1bc89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc6517b1fdf1c728b073cd2d0c2dcb21

SHA1
4dd969e990e3f6f9ec104dca304a2b620a7407a4

SHA256
f73d2be6ec91ad9f01476cfa3585c9dfe376a6c93cd2b8c0b7d25505dc0bee35

SHA512
793b89ca936d7843dad4fc3ee1a71b60a1a6cc09180ee157be2f0379d73fdca28da71d33d7ba43ae9b7e8bbe4fe66d4c605ddbecd2a162bd96660a82d04263ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a03e0143b7dc679c787254e87f20d75c

SHA1
b13b72c7db581d604f326359864052cf3dce37ad

SHA256
dd3dbc9cc14634789d731969b59f01af234d1259b598f0fb270f75c986922de3

SHA512
7a02f9063f91b1989158dc0f9cfdf701c9b748bc79cea747c8294bc37407a162354467f893531f1487744cd67e00b420750bbb2cca38d72095ccbcd23a6e9561

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2008836bbeacf6c5549b9e77b1ad0180

SHA1
67676d4979769749e609245139810cb1fc718091

SHA256
0af9b0b71344f6692d068dfbab8beb7dfd07029cf49d81f4cba7965ef4d9c8b2

SHA512
79b69984eab842a3073db7f9cd8011b97367a10648d3143e2b87cd4c58bfb1f867137dd28f98b8d47e2cacb8e7fddeca4f83a887e4ca2fcc4c818b6ba9c8b91e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
59201e211187326e3b8de64fc2fc30c9

SHA1
e7cf3d6a24e7818fc5b6dcfefd55258c98d3b96a

SHA256
69108ee6687e225bb74d7eda59d687182a7231ac46f937ce197e1bb138f69222

SHA512
6281ec1cbcbff9f1e4b8a8065cfda84069d27da9ffa0c42483b8d1d8fb9f21902a32f87e3364f8c6482390df00989728d53f9ba3126b5b153f637383aba1d4d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eafa8bb84fa92ce5eab4a0e6f0366058

SHA1
7de11ea2d3dff0d46bccef65e03a3f38bc001f5c

SHA256
55bbbea952bd73f140678b1f17820cad964b6e8a7ed0316fb752f7109f4edf71

SHA512
bc123d29179b764b6be82eabd3e989e8a454fed9fa5f5d7d714a9b2f92af4c9a8cc5712cba77a0d7d2469278359a2e31fc28feeb2fdeca682c1b27c4bf9a2f2b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
289d8541987b10ca388a121970a5c50b

SHA1
31ccd314d23d68ce60c38b815f74c4ecc3a9d08d

SHA256
ebdac7083f9ccb39af0fa5319db4018a746a967a8e538fd43788e2a6cfc4b32b

SHA512
887794f1e0740d5bab1709508cd19e4c2ff7562486973a5d69ea31aec3ce267884134ea94e55f36fbb33bcb6fb7c77ff7b2daeb128562675729ef35f7ab1cd73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f2e29426603e825dddb86a97dc784608

SHA1
c3d17ee28096fb36e82b20c6fcc05a9907f38b51

SHA256
e64c530db802c33e5da849904ee817bfd24846168471c16d3f483744aacd1b11

SHA512
ecb2917b40f8b314634119131be80df283465af48cbcc2c558c1e4cdc950149b1f6aad6613e8e03460003fd71ecd32963a067078c567bcea5d39ff8ccb041cc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
709918cb04bc086058769ec57afe6a26

SHA1
676d384546d320c19bf0f958f9f9daf6c091856f

SHA256
61ba1fd0f5bf0693d3acb28b11d7f35a325b2f97be4101f5990f64473038e091

SHA512
9c282b33886b611197e7915458df7a3594c177e46feee45c9044294525fa8c1db2f65963b807b436009e612d0b0828ee4efa64963c573eff5ee56761e9da3fd7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
496121e362daa0b19962457fe21adc09

SHA1
6fe51df3fefa9f09d2ef076e6f0e49c158d932f2

SHA256
c8659c539caee24e29923d07f2e8a51d93b13e504f8e2657945d9c92f2fb38ca

SHA512
f2137224b542243390ee9e4f55ac2bafde4da33a0bb0c8c8b8e025f5a339f24cda92f7f87ad8ca7443e38935d936458599ecb842e8a579b84564f41093865a45

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc46e1cc1a3e2b9cdd3e0a1fb97c6fea

SHA1
73f8e843cdf95cfa7535850e4965c82c81feda47

SHA256
25b5b8a99243fb3f34c89ecaaf954f9a84218665c5229ff16241ffec664b5def

SHA512
09cfc0689a7c944442c8596bef7e6a1c311d4aeb986823ad7bfb4875ae40544783b50d885a3bdcd4b22e1827f766593ff242c98dae17d825aaf4e5b710ec0af1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4cec105aafe4e2c581daef1ce6385a79

SHA1
dcba03c046d991362be4f624bc6ff3105a78657b

SHA256
497812cd41e2344d565b292ffaf6eaa375c6a8a66522a07db8bea2b8a5dc20d0

SHA512
128c98d1ef4d629ea8cdeae9d8c22dd2b61efdde8f1c6c44e0a4f055c5e8e5969afddeabd5a329944000cf2f0c69831665346d87f8801dad4ddc16670da4624d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7c1bbcaf03b45d374eecfd37b7ce750

SHA1
433b14f05f5e3a3977663d25d2c22f4ec6de5ad1

SHA256
a666be4336a57f5de968164e988991921242ff703d2ccc27f668c49df1e7d17d

SHA512
7f7bb1402155f3e4c0ee29a08050d1d42557ce2b3fcebb65332924736c37fc527760bb7b12ff0b7a8ec845c14906adbe9f367e2710ea6236f6664d669a995677

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b7684b5a84798f49cfdda364708c17c

SHA1
37bf83f5aac07bca3214ed5c58d7b1508a66f6fe

SHA256
f32915154b89ce9f4e3ebdbc1727c06064bad805acf171948ca90153f219e5d5

SHA512
31baa6edcea518f98e07d2f10ddb69146484886c8d1c3308d85f645644f5c2aea7c3ceeea14d95e4603d2babb87b70712c66c4f19d083c76459fcdface8d873b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4165.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar4177.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit