47aaa694d30001d8e09914e50237212a6083f89d6f5b108f090e4b4a5c64cb4f

Analysis

max time kernel
145s
max time network
147s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 03:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

76d1646af33a4fb5d7a935c78b73871a_JaffaCakes118.html
Size

18KB
MD5

76d1646af33a4fb5d7a935c78b73871a
SHA1

07444f58cb257827b53b6739ff40c44501690956
SHA256

47aaa694d30001d8e09914e50237212a6083f89d6f5b108f090e4b4a5c64cb4f
SHA512

bc07459a0692b52b4ee3d45afb1661b4b224ea0b10335b1c7dd9fef7924668141f8e851a894af7a2092a83c602eca1099fa6ec79dcce0c5da81bcb85425f92a3
SSDEEP

192:VQ5cVZ7oxovwLd554ba08EFhI04YLXlsPgdWZSj0VuPfGHciXOdJgU8LallSK:e5cVZeNzeMxodWZSj0VuPfQDK

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000ea889c3768af1ea2eca47f17976159e93d5711f54b219f5a4c9f473a04f8140e000000000e8000000002000020000000c11a1a42a7b7fc5f37b220fefd8508f6c55c2b24977b56d95f0d937d5a05d88490000000a3d5745a2f91cc006f28331feb31b31648794223937e231b99dda83ea66ec187f079fe00c2473dc318c4608efc4e610db902c27d4aa20d6a7ba762f5650c5e939cad59bddba6e383b28121e089bb2edbb14e6aa15dbc60c244397f1fdff16503203589ced296e6329eae23e4858136e8c9b98a79f18f71b5d3b2c99555e53c514abe8a6198e41b79516907cce07acc4940000000fcd78998460541a890c2db49fea6d710aec7609e956639ef34d79ad9239271c6813925e827ff7cab04a414555bf84af1617bb77d3613d40d5b6cdb3d998828fc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D86D55E1-4E35-11EF-9CD8-667598992E52} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 402b4daf42e2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000f587de74268fb97a520542beee1f0328da183031c4bedc9f48aeac00dbb75c67000000000e8000000002000020000000a96ab2c020a9dc7f0d81633228fc6ca7729c7c20e069f2e526363c580aa4c658200000008a74369ae4cc01351c0be5e69f3e6ca140d6b2cd7267e0320ce8aeeba00f9f0e40000000ffeab290a47ae2422f280503917c2975a707a62cd04e9f5af3ce5270272769d3c94893c69d5fe9aee57a40fc4efca33ef2fff7a133afa510c1412a7cdc9cda82	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428479735"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1488	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1488	iexplore.exe
1488	iexplore.exe
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 2472	1488	iexplore.exe	30
PID 1488 wrote to memory of 2472	1488	iexplore.exe	30
PID 1488 wrote to memory of 2472	1488	iexplore.exe	30
PID 1488 wrote to memory of 2472	1488	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\76d1646af33a4fb5d7a935c78b73871a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1488 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
87bb3b8f9bb8c7f0177898f3c1650842

SHA1
cc590ed90aca806f85335f935063fb66a9b3d340

SHA256
ba90e40c1847ed23f41e4499d2ffd0d0f616714506c1fdc571b4c9a9cd7a7a3c

SHA512
81b2645c31282d60525729012c7eac46f9b1948ff1852f3b25b65744ac0b278ceb9e5cb1466b578e682d7978143adb6f5d287b98371d6a655ad58a5ab50170b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
151ea264c2473158a853d4af06295b7f

SHA1
5a93c4fefdf295cfc20c2466c0c74df2894827b6

SHA256
380111ee32eaae8b912b83e9c33adb42f043282b0e6c87c3511720a68c5ff09e

SHA512
be79b8c4a19fb218c755707f2e623d064404b3dc5fe36f8c863bb5def8cb6b12e8ed236e3119fec16225ef0904cf83ef42190b4c89bdb49c8b0d6373c2e5d8c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1e5c4543996c6ad3fe724b8a48780bee

SHA1
dd6679e38e9963c84c25d0d0d3d29e27df4527e3

SHA256
71a13701abc26cdac7372b92226dc90ab5e2608f72762c5366c765d6799d5e6e

SHA512
80dba11184576025255f2598296d9ee6ac30fc128f1864a3c12918f733b66e44f751cc4c588c18616bbcaee72d88c751b9f3b63c6477c9ca6974bc5ac7df59bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a4484cb33d400b7db5ff8b1b7ad9e7ff

SHA1
32add0797381d2458a18b15213be990d86e07457

SHA256
28687b2a55dca8b191501fff45a37601a9a6fc1353c194ad9e60cf5d442aaef4

SHA512
3d353c91df2346a61708f7343504e57a8fb952de99175c1b6ff323ac5de539c5f0a50156125230a1e497dc4badec72697a954d6f50c3d05cc0fe73c586d967e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3349a72413862456ef6f3df53d46bf3b

SHA1
84cec56c8d98503932952defa0a7cfac56348b94

SHA256
d0a98434e9e1cd32ed05b727efc6a14eaa28ea67df7e0abe31bf69419fd75983

SHA512
8dccb93c565caad9c3a43ef2e7d4e58c33941283b2a0ce0e699ebf5629808c9bf306326da6683682687e13326bf38c5ab109279b67e936b2f4cf313559ac1378

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
69d5966648b18202724f7a476ff3bd24

SHA1
17ba63b62d5071baa40e8743310aaef1dc0c9d52

SHA256
a8f3e5f90e3321fce44d9d6a6f54dae7cc47ef91620b2d44c5a9a16989daa047

SHA512
be543da4c9f26f907e14f2aeb55ef180c4e32f97e07d4b1bd57f67c75db828ea2738998ec7827558c8de80c3ff219c5cfd05f8e15f26ae1c96f507917dca0e9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
eda5b68e65f82fa692cb6a08390ca5c9

SHA1
9573a9b14762b792baaa9397eaceb596ccd70d02

SHA256
6d936638addf419f632d5f5a7d4b25ea73d508d8538a557483405dd5a0d7d1d0

SHA512
f61b9ed248bed56810380147413c52a40031a3e94e23d080dd3a66edd0c3af4b3d69eb0895201876a83819c9d5f60d9a9117543a4754427fa37c20dcde92f7e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
1a525dd78e5ac3eaf4df3be6dd107f43

SHA1
0d5fde4e2fb8c37bc0ddde57eb6462111305373a

SHA256
d862fe88bacfd915d3b85f317d349751cd334061f908b83d556c458595b7c6ef

SHA512
370ceea3463474e66669281580769509a6411641ad6f19288fa9f235408f14c7cd59d40446c7c503ba0fc45083c563b638a2375cf7f791602248d214100d42bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
910ed3471ff98d04dc9b78e83acd8353

SHA1
0df503dc639265ba9a348adebdfb9fad5f9b773c

SHA256
cdc4140af89a1f6f9cf2c3af0c0567fa707275c82a37ac0e77ef7d82580537fa

SHA512
cb2429fad24fedbda3dcf78a83d45e0abaabb2f2ecdcfa7cec9483f736056fe96ad6e9c0962b059f081426d41ba55027c1d2eb8ac0a32d80f191a17bc79fb1ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a7673f5f9a660da169a4f36fc0c459b5

SHA1
cbc11f8097f45272409bb31e971800ad3db7a438

SHA256
477bd84e7cb685f436ccec10a2f324ee1d03a4c879ea2070f621495db84675c1

SHA512
a62ba73e4ce8214bab828b0e7bffe0982ab950fc197c058d6a4c47b0a77df14afd4ac75e3bedfc436c3bb7e7ed5db22020358d9d506e5b6f13de81cd1c62fbd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f6881aaf80d08f9fb790beda10bcb3ad

SHA1
efae249be91ae3a18f4319ddeb04164f2ed54b6e

SHA256
5f4daf2b067261630420642f7a29fb87e3b276cec0bfb1844b7c1f2afac5ef74

SHA512
b09c886fc9540839eaf026cde4f57749af478a531dfd5229c712bc0c8a614818d419914cd8faf8d2e28b1f3f21e7b35dc95034fc6e103184433e6c6b3c4953fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
cf193c35437ba2246f17f27bf8eee9d6

SHA1
1e1a2ce026a3535414b995745ac92cd4b4ee6465

SHA256
bc6346bef239be904b653c97e872df2c2ba8c2d0bbd00e681ad63af8251c8afe

SHA512
d3e895ab587b9d2650c0b0213c7b994f751d8f0112960eac1b95d5c4ff6597b8ab0982d8f7e8edf730246302f205c1b31caf02aa3bdff8eac3c9fb4cb5ff8be3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
aaf35132b5afd98befc8eca5a1ec0a3f

SHA1
d51b986333b4c5091c5beecb8ebe40b250d6f844

SHA256
e9c3863501454885c998a8603af53c8d9eb74f663d615f87d45dbc2c7ccbe36d

SHA512
d50ca914e25f1486080d6d2bb861b488efffdd7872dbfb8943abe045356eedbb8de3d124193536db0a290ec0c2e1cac96c1e461db79c30528c74f1f0cc0d1e2d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
c3032f3094791d2805ccf3b6626a8243

SHA1
d390235148eabf517713987bbfa38d641966cf8d

SHA256
0dc53158869120ed63d1058a9c3ee38c88ab8c45db7dcaba85c7a0d24bb42c92

SHA512
c968ccc64d95b25bc931c2165fc446f515d109a830a12e40df2d1635d91d0e7177e9a3cfef41f530cada4dcd46947d748eca08dcb094cba2b2fc117232902dc7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e0bb7f8576fe73cadcd7a318255b5d7b

SHA1
0bd347a86de399ecf7cc4ede3eb49016d7ad7f55

SHA256
e2e95b7e955333edf371286b0926d0f7c06a2ec1ddca3c4faff141a5a7670ba9

SHA512
f7614aa339b31d4449866c33f47fd549b451bad104ab68ecedaffe6eb55b85040a61791f1f8cc01a8c53c5e76a0bcfa0f0bd82bd2f9ae017569b27146fccff29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
57c4dc8dbc0ef85fbcf73c6eca9a916a

SHA1
bb013b20cda44443033ea94775929c5afdbdbd0e

SHA256
fa7cabd5ab25679fedf73ef99b8ba5aa95173a1133e2454664d11db0f5e8928d

SHA512
625164e29f033f1feffd99a64057523a377c034c5c6ba742d53952e7fe121262896b5ec774d85bbca2f4a69aac9b55e4179e52df674de0e20556c7b98a8fe0b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabFD16.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFDC6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit