13e3f499d60e766ce251d1ad9bc106f73acdfc52373ad0be4bf00044a66513f3

Analysis

max time kernel
141s
max time network
143s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
10/08/2024, 22:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87e1c860e6e22f664a7de4779507ec8c_JaffaCakes118.html
Size

57KB
MD5

87e1c860e6e22f664a7de4779507ec8c
SHA1

8bb140f54cc9f1776a533ddbb48d15c57d0cf975
SHA256

13e3f499d60e766ce251d1ad9bc106f73acdfc52373ad0be4bf00044a66513f3
SHA512

c617a359c40e8685bff5ba590a0a7cbda94eb2ab4b111781e7adedecb771f90a3591d908ea9ae3c05e6572a0ebde7924e95e5bb722a800605184101e8284c620
SSDEEP

384:YGPfl/7ZQu6tkzXiE+TJ4/LNfNgHXAEnWYEzJqBFrgscs8POAnJzw:PPfBamXiE+TG/LNfNGmn8PgYWVw

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 39 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F6A1C8F1-5765-11EF-A372-5E92D6109A20} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a0d265e772ebda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f0000000002000000000010660000000100002000000070a420fc07d18e68ffc173e17ec4e791f893c071e9ad18d36a265ea248ddc48f000000000e80000000020000200000003d095ba24d8a91638e45862b54c6ab0428f04aa4372f3d63d186ca2ef8ba205d90000000cc43fcb05d153e14ab84f570f87b53a8fa1563af97829135d0f2b87c099ab54f0dc36a5e3fcf770534fdea45d4065c06b474336618459fb2ffec03c7f1d94c7d210e3c00473c7cf88e5e5df6c903082a9bcb1686ca4bd9a70f2b159ab9ad2f2466f358f9fa3e022388cf73e1877d46fd21f413df7ebd6851894b09bf1503358e7b910025b7ad1a47a1cc46bfdfbb8547400000003c3c1d44aa26ad187da9d56e894d279a2fca8e4d702796f1c4acf1f4ed2fd69dd1efa1a7a23ad4572e89b9d1d20c0bc270811db3151ba34972f08a4e422cc56e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000dae9f597d06693e47316ba066fcbb26cccd11a9ffad91aea5dacb66ed80b702c000000000e8000000002000020000000557eac5c97818d116a9d5c255ccfc4cfb6b1cafc753312cca8270156131c805b20000000dec52dd6b25fd6c1e8105c0c0f86db9677921993f33f73f28cdb72299fb2e9aa40000000d91b2d52401154e0b69badae7ba9a7dd130cbc99221db88a3a748029597d94c5abc17aff39d3db8fb4d55753b34d4470fc1312404c325e7cd929d0a3b0b340ab	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429489973"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2988	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2988	iexplore.exe
2988	iexplore.exe
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE
2100	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2100	2988	iexplore.exe	30
PID 2988 wrote to memory of 2100	2988	iexplore.exe	30
PID 2988 wrote to memory of 2100	2988	iexplore.exe	30
PID 2988 wrote to memory of 2100	2988	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\87e1c860e6e22f664a7de4779507ec8c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2988 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83965f7036df60ae37f0a5316b98d6f1

SHA1
dbbdd483dafe25b67d10fa4acecab5497bc09f17

SHA256
9022310591a23e2692592407df571e1a64e3a1429675a77560837b53874ca0f5

SHA512
3370571ef8673ecd1c69ccf969ffe62e06b56caf023f1ed5914c2e4f19707f0ffb739c4bb67bf0718181426359f77a9b7a9d0bd738850bafacdbb2ed218a3125

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b110ca065dad4de34ab7adf22b07522a

SHA1
048e53cdb91c4a0eb444737e6e3f47bdf007cc5c

SHA256
eb13d42264dac505bfb7817f382cefe31e651cb8140fef0a6f2c718b1c503447

SHA512
78e25287ed49497dcc909c32d3fc76484b1f9d8a2f8fe74e5b5e8715651478f7c92bd599501bb975aa8d855ca1a270a4e9dececa857c836f1c1c67613d73688f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ff739c07440168de4a98fe9def87523d

SHA1
24cec8befdc96ac29d472b9cbc0ee7cdb4031b9c

SHA256
dfcc5aa252775da6047ca27b1599148c6ad3b4b425d33868b740a659bc1c6d3b

SHA512
d5c8f8064510894fa4ffff1f80557974bf6dae3304514eb20e9e74cd4f394c9589e1c271804373ef0e86f5de9298a06b010b9b605732cc61a4065371603728c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
071ee01eb8b8092163332cc3c608d197

SHA1
da2104d4c613dcee1ea9104a7c36022f67b45072

SHA256
81c6edb3c54dd264eace9c65441d4ddc48f2e26edb8943fce00bfb03a617bf15

SHA512
acdeb22afc90ca8c766d1d97f5f8fe7fa32ec460677e71ab6c378a9fd5014c76ad0552a1422c0093baa8c9d43e47a555d5a6247d2017a05ec07b40b3ec360588

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03305983db175f266af22472682f8e30

SHA1
23a139be1f2a6672d587f6c5894e54d5eb078a58

SHA256
fd7e03e1bbf542bd21c7b7e1452b65f8cd7580a9e65ae4d3bb41df30774095f5

SHA512
bd40a0986998d4bfd3183c4e9dadef6198abc544e660c1d987a114e0c46f3fa8e70a433d20dbd87ff8d94a6efd69f6d32de62a0e2785bb980efa82ab531da7c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2155384b17c651627179a69b60e9fab6

SHA1
94bc85821f4cc6909b525074b67be838cae17b0a

SHA256
211deb97012f14e56e1efa84e3241ac3f623a3c7f386763ded8fd47d37a0192a

SHA512
7cc82ba533480029e850554283562d761e9e91eee6deb4aaaa1418e220cf5c78c218270525ae6dacf9bf4bc80f2fe473731e228c027bf76a72b01796a2dc1527

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bc6bf5b2caf7a372eacdb4471acd1b11

SHA1
f816e644865e3673e4e867ed7acb431f40ac4cba

SHA256
63f9c74a22c6aef3a191db8f91427ec0556652c12dbbad104b2fe74404eb6c4b

SHA512
42c535f2e03ce02ba48314e9db387d0af28946566cb0d7d42517c7959143617c3255706991af5f728dc7f90be5dd89eb475377599c6a4b0fa5eee13873ad16e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b071a53ea5fbae8f75e6e2e6253aa016

SHA1
c21ea99449fa5a15afa47cdf8cebd50a07e89cc8

SHA256
c23dd858b238fc7268a6f20e36ad78ae68cd7f1a12ee55121bd103181f41e88c

SHA512
fc0da81fd06b8be111f1a3ffdc3aa2f531b84504cb1888dbffbc3f4ceb1ffaf107e6969904d6dda3833350e02c2dcc91817879f3bbfcb6a202e178d0c3bde45e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7886e06dc68d2b695bb91425cd15f2ef

SHA1
f31e3dc6faac96039d97e37008ce09687c6ec73b

SHA256
d2ca22c5089b3edb5e05b60506da9f333e1eac30af711ae0213fcbc9b5a88932

SHA512
6b0a251b8c8bdf52492cce978fde2df7f066593dc0e002cbd5e913300477c604c06490e27e764cb35a89ec30e08c859518606f8690a12c52cc68f4eb2ec0b5b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8b0b7fd10599438b1407c4ffc7236411

SHA1
3ac6fd884dd8e652f22a328c828b08c87ae77d98

SHA256
e8ab2b8071dcbc7591782a33595c00bc0896a7c34d97a231ddb35a100431a4d8

SHA512
c4f7b88d26f5ca19e033446488812a7d85f9e53cc94c35e17f2b87da0715273a8ad1a9b2c2c8d4129c1f2b1ee23b1f0e57c0dd5bb6ab9dc25eba48567dd73328

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab78AC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar794B.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit