4853b6d0cd8bd9f087942b71ca12d92e749ec08036d4a5f0c4c7900ff669dc1e

Analysis

max time kernel
145s
max time network
147s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
27/07/2024, 06:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

772e762e4b3f1bf2ff769454d5b05d91_JaffaCakes118.html
Size

43KB
MD5

772e762e4b3f1bf2ff769454d5b05d91
SHA1

418b188284f9f79a3ea1548d734cf328d660902c
SHA256

4853b6d0cd8bd9f087942b71ca12d92e749ec08036d4a5f0c4c7900ff669dc1e
SHA512

30e63685fe4dd35b8551474c2ed7db3c22772699266601054c8439a4b47ac974e107f2c2868cb651c428723fdfb82ae3353fd4dd71aebb6fefe77363a7d5433a
SSDEEP

768:mltiGiOa+mrCDwhcP6be7dQJqdHtBixiZ3LjTBNe984o:utiGiOa5rsu9IoxCbjTBk984o

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FE583821-4E3E-11EF-B552-FA51B03C324C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000b468a8ec670212c264b7557a2c893e4becb5d002d7172d6aa27b7d0ff9c0a355000000000e800000000200002000000098b8c1f480f8987991fa439626eaf9ea4e4cd55487bd5c195a488f5759eb348190000000f0912a8ed193270f7e67b82d3000f04899bffb16a356c0369070afa644ea71f59d994195e2a1bbe4cc6ceeeed70b624c256413c0cd8b7ce0600d96a649a292202c4efb64dd8e8aa22f0b2f59c76d0a330ac137c9a995cab5b090eefe48dd0649e5155b09cd31263c668fd1f321cdc799b5447d33869d54f46b3e84681485a4c7bd77b92ae02f000940fcbbd54fbfad394000000000ba377addad3fbcd999314a553845a34b3dd5a4829c63506aa7be0695d66ff59edc7869487988290b879f68af62680d51181381d5f599cc4a69b7fdec3f85f4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000fa9e72e3db6caab55822add1116572eac19e1fc4387da4f8a8175457c4131419000000000e80000000020000200000005127834982c303f60f04819facba400b3a17f9a45eb59f2746269350527a26ce2000000059d2dc96b65492efd8774feaff171e9517f779d250c8e704c3f9e9d4115fb9ea40000000e75a11135632167b0f1402a9d40b28a4f0f6d4e069713bf677809cd377c0dcbd71eb274d9f49e9d3ba44da9d96d5f54631f62d1051e857a31ab4282f75ee5b02	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 606a66d34be2da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "428483661"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2156	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2156	iexplore.exe
2156	iexplore.exe
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 2784	2156	iexplore.exe	30
PID 2156 wrote to memory of 2784	2156	iexplore.exe	30
PID 2156 wrote to memory of 2784	2156	iexplore.exe	30
PID 2156 wrote to memory of 2784	2156	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\772e762e4b3f1bf2ff769454d5b05d91_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2156 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
877d24272226c23c3558f7e1626cff40

SHA1
3d11d7ac5e2a43bb38a13902a6589def62603cde

SHA256
b7e60dce91b8cbbea78331c221ab390de5b464529edc5ca4acc2580760000396

SHA512
1608acb5deb28e27de335358d5e21a3bd631a85474f969c2069e378a9a6533214f613ed2dd9bd993eb190c2492485db9b469672bb4845a124f8e04d74d3451b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bfa35319770d3d1526c66fb9fa019e26

SHA1
5b1ed35e2a7fc61a08e143a65c3331e50665e977

SHA256
5de568a622fc9178bba27c925d4200b2f723fbec9c337898605cd6e9799f4ab3

SHA512
b64ec0e0b648a16407ec33a1d485604b0756505b69f745cfb28a959e07fa46e60ea55c281dd68a0ca41a984b6415a4c3486a45a45bfb68cc514ea509b418ee87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
775ef443639a4ee59a1e905c4cbc3358

SHA1
cc4ddea72ba690e9571c0793ef5566195efe3151

SHA256
f304b0b67fe40899f833982f603f3053c5922a96d70a93fe3b1e8fcb82294910

SHA512
d14466da192c38bca7f06f2b9c656f9680f3ffb27c29c3e37cd9be0ca868528b0f96d3a8e9dbf6a3006a08f940c6db1c8d763984f3cf4b664db858ea1ed3c3d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba91320acf480ed0c2a323cd3cc9c4a5

SHA1
f6bc2e466f8646407d017ae659c2706bce116d2e

SHA256
189ca7557d7ad3be0e85d746e1fb2d10cd7df4f6222bf828b508e397cc85df84

SHA512
fa3ac547ab046d9f3a55d02dc1b3730813195d89d41353d59cf1929d5e07ce40a672a1a23fd19392202dfa74845a200c245e894ec98e0ec8b8338ac3b87b968f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90822e290fae2d12a0262369b8b2e6e1

SHA1
c8f5f53d3217cf7810f9c313187ffd45a8484c79

SHA256
d7b0d97b666d63020477da0032d1d363578f78144de4f5fd33a33cb166daacc5

SHA512
c2327104bcc2191f9c9d100d9f96d5f3977c10fe4e6505a96eedb5200e4a00c8109d9399ee61853fa2c46bc87976daffea21f96791dc298928c6cf6a4f9bdd71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9026b68f1e7462a9e50b4e89e6855ce3

SHA1
80d16fefdf0a9dab9a9c340cb3eb7fef817a105f

SHA256
2291deb1225cf5556b090b92eb0bc3186bedc7d8eff5b9194f4f91aaa6e3f0f3

SHA512
c7a9b9b2906402db8502c4abbc5b8a05238e86a417f636a160ac6a728ad8a8bea20a9d3528ecbfd2e1dc04be160c75fe62bd0cb790da0122146b09b212e3d3b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbfbca7d4aeacdd6c91bce45fc16e2cf

SHA1
9cd3eebb5e33c2ab04cf0d170fe6e83afd7229b1

SHA256
d9c1b704493a91d7b128cc53e5a522d3c24b1ed938e2add929ae23755e0dd6b3

SHA512
6a8a03985f7db3ac955dc05c98ef98a7ed6d694f10de231728fac1541b8c2ad8541593b2108fd9487cef281ea66fc8bec7a445a86ad7b61d48a5fb9f78739805

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9144bb01193beb14d1fbe8f27cb03aa2

SHA1
9568ca494adcfea2ffc42478fe219ffc24280117

SHA256
9688b75ff0cb1a6102f154c793c5641869a5e16831a65e6a0b62e0b642a604ec

SHA512
c35e04ab4664bb3099695276c1faf9d517d41c2aec86b44ec59c28698dba4f487558a7525dff89a6a234974cf216c25186f42612ae5a6a6c3fb616741b85c64d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74552083ddcb0d6470e44bc6ccd0e0c5

SHA1
216de150d23e7827ba93dc8e017b320845cbbfd0

SHA256
c6fb85785400cfa4bac06468966f93cfefa0abd8563808a99ab6ab452e357180

SHA512
bc9ba370e12d244450a5734ba109cebf5b8f38324a42b67069ce460d9586e8f4aae1ad0c2fcdb0b8ffe355dbbfcfa3c6c1e2ee1665e6bcf9606b8365ae71752c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b436e672e98c4e8793d4a24b84f3db7

SHA1
68b10ad97da6cfd5fbfd5ddf1602e82c5078ddf7

SHA256
c830e784b1c198c508880b77090bb2c060b49f3f71a9d84d41a4d59907303e9d

SHA512
c21fb34388a9a7ef748e4936bf7099e4e7db63ce77c103cd8ccd15f6dd818f1fbe3ac11ec27f89b834a64322164392b71880ef6cf73be7e1a9706616639fd13e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
684d948b260de67fbf6b69803d6edde7

SHA1
5da9a99477b3beb2c45977ad3a97f41df27a6877

SHA256
1484db09f0ee6471147dcec6e3b67ffdffac32a3a1f8fdc786022c97c4f7fcb8

SHA512
bc65cdd8ae971ae4e469a9cdd6443141837f7f7a0967d20a5cc31e1c52381d288724276ce791ad1d9ed1fb277f65d354e6246cd79137f186e2d32d6245a8fb2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
889ae85f155129f0c3506ecaac739173

SHA1
48cbd5b0f54b1ee56720aa38e1eb138ca079ebaf

SHA256
ce6e82e7b4a73fdb5f56ea5620f66b58b7569a64879dc71c24da0d93018b5ee0

SHA512
1d9ee6fef4bf0ac729125c60938d914940ec18931bf50f26a024f5eeedfc80cc3735bf882f9750cc93003fb4f7eb71583a297b25fa2b0d435dcc5c37185cc6ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6402.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6405.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit