bddb6ed43b42c5075bb9dc22108011ebf5103468168f7c2440346d42e4fe6137

Analysis

max time kernel
121s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
13/08/2024, 22:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

9502456a37b43b134ecc6958242fe6b4_JaffaCakes118.html
Size

3KB
MD5

9502456a37b43b134ecc6958242fe6b4
SHA1

e1ddcdcc6652d9139620d265c4c64b8969be0f19
SHA256

bddb6ed43b42c5075bb9dc22108011ebf5103468168f7c2440346d42e4fe6137
SHA512

3b65b9188fcc09483d90d43604770e85ae967adc7983a14e6ab07b945bc8f31610ab6c28325a1f42f13f817540c295329e2d3142e2e806bdb1b3ef6d609538f2

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429750291"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000008a2e18f078b6a3648596ff1d9e4dbd89685da6402a853a603d74e870c1b0a093000000000e8000000002000020000000df9052b3a9040395bb023567bbdfe16d143f8e215e3f89b2ab7c16a89698d1192000000042193dc27589035dc7cec37c6c6beee3fd9470e0b6ba2a0e2b145ca4ed5c9aa340000000b7f3db428dc6512d7cb36a3d49fba59eeae5a77918b80ca8ab410c1f60dfde0c4066479714cbae2a0882380b0185e2d18d6bed898fdfa192f949fb5ca5b0c68f	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0efd1edd0edda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1933CCF1-59C4-11EF-BDF0-66D8C57E4E43} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000dd57d1ba8f6d0ea34d91501a143bf41b89e2e292888886e017dc91b374ed79b2000000000e80000000020000200000002e45a11e65189cdac963ee023c55e0a009e8b9a91fb2c645f7c6cd5655839ce690000000e89abb9a983d53ea59b3eb6cfec8650b57423a01c756d3bd8c858887819992b18967df41d3f67af8646a58da962fe96955dae4a2fe05ae28c1c245fc4b70d63d7698d41e317722110bf33769c936968519d8c2ac142dde43a3978af8b4f69166a27e0a01d42cf2a42ef3fc05a029a47254beba1b7601399ba702fe3a8170508c06fbccde1805fa15c89c4a1c48fc099c40000000d8992d42916e29b067c41d00f6c54d7bebbd9cc067bdec7f5e66c22133be5eaf62061d5d6c1f6d90cc2982006a99021e34512a0566a7b5f325edf9c628730feb	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2720	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2720	iexplore.exe
2720	iexplore.exe
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE
2800	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 2800	2720	iexplore.exe	30
PID 2720 wrote to memory of 2800	2720	iexplore.exe	30
PID 2720 wrote to memory of 2800	2720	iexplore.exe	30
PID 2720 wrote to memory of 2800	2720	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\9502456a37b43b134ecc6958242fe6b4_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2720 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a187c99b9c1d74b73ffd68befd7f1b18

SHA1
802e3e658d108ae871eca3493fb98d10cb90d7d8

SHA256
2b8ea71d18123b0e354e63d5a0c6235c669fed9979144b45c1a732eb59541e76

SHA512
4512972c8e2793d77cb0a68541d50e0e5d22bccc9884d9e71520112045ce98dfec5f69bf80c22a6ee566fb183b498608898b46996bb0d1926696660c07b194a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5c33be0aa433a01f8f8d8ee22747af1

SHA1
11df482134212edb4a0efac276f1e8dac546b686

SHA256
8fafec910ad928111c61e62258ee30775eca40f097be141dbffeda091804d60d

SHA512
d8fde3d3cb81e1110aca1b42b358056ae8195fab2d68d3403ffee0602e1c9af0adf3d6d7a69bba8cf4a36b001a07eb02e834ac2dd57e74fbb818845ea94ad949

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81f70cb39cbe8bad595238997fb8d8cf

SHA1
18f3dda7a7e9061604a51acf7d91ac252a1fa438

SHA256
c7f10f803c5766e7c301b7f9da5edf6c1d65db4f1c735d816c896f9c3deef4ed

SHA512
62d13311ad917f4029bbe5a2d751bbfc1fc0e4fde4fb75277919b8359bf4c5d4fdccf18e2b1358c4f193c04b73961ba46527e1128ca1b7d7ebe8d17fceece88a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
450a3532d1a4835f6b133f5bce269266

SHA1
95277750f6c955904d58ef4464c953908269f996

SHA256
066c1999ddde13df34b27cc58151277198316cecade8cd8cab0657699be51799

SHA512
1f0af9683e9809818f1c3453162995ba165351e77fe32facee3ce123d41fd9544fac1f88e1f2b41aa796cc2d24f8e4105affae0d7851ea630e2719c9a9990ccc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
878567144872077621dc7e8d5db1dbbe

SHA1
74ca53b05e5b3b987441f688f39466ea9fb2873e

SHA256
e656351e028cd5147507661b3f9ad1e273681d2ed1890c78240d16b3c0c8ef56

SHA512
fc8c85f2ef53b7449ec92cb85ed3a84976982cd9ef4af9b2455521c4e2983c60a09f8dbdcdd7b4a00456bd37f65a25107867bba33807d9e15edf0ca71f4f6f3e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d6251bc922b56d00974414b12950a91

SHA1
3f6f7988e3cbb1cae2c152bb106d2a10c3a0a785

SHA256
4d2dc1ebaa5e88471342037e53cefc449d2c3718894685c07059e813dc37fc25

SHA512
f8d90828cde69869659bbb408837b1d62ef34fd66718ae4d89e7b3051886fc80cf2658465cc94c57b7cce8f4a2644a9b63fd3c9ccfbe0d133daa10f715961869

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d48631aacf41f13996918c595e7f24f4

SHA1
625cb8d0f577255d8980502ff4db1ad3e3ddc672

SHA256
ed6670cc28daf28392ca3601e4eb4538f02155e6a210b00c461d6c58fd20e196

SHA512
bb06e11d43c1b95823e0a167cfa5e5ed464763c3dd0d5c9a08e09a2464f9de017dbb81e0d6728db2d02c2c159113faafbcb0709c2aab64f9c3560e9fa8f7f611

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
001e62e4fcb8bbc5eeb2d7bfc1a657f0

SHA1
37b1f601d881c33525ffc6868d0dd3d922f3fa3e

SHA256
16986394c3824b6ec328baec4524f5ef3e6529f88ca5787071c65cda58c102f4

SHA512
e4c2ddd16150b8d7071a3b9e86458f2c0f1f21f415452f9f9227ba376f249a954a957151d79413f322a5e142091a4e43057fa9e514b76d7ed0e78b65ac3718f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b92bcce4ef29d503c1ee42e1991cd2a

SHA1
9c35f1566482ef25c27b12a91a073f6f5f0a1a27

SHA256
bfc909bfe95d80d6b0b3bc47ee21256647c43a913128e29482ab6a106a0ccb6a

SHA512
5564aa946888ed84f14ffc0edd4524be1f05ba926c2fcb8b8f1d044763079c4c3005bc46b43c287cd48fc4f35c6b80f1e47fc4a9ba3ced072a262661f6ac0013

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1d7bdd48a387e8b99db5c3da3259cb27

SHA1
1a502025d50243abbd53feae8a92b3550e2ffe98

SHA256
b8970a88e028ade9dccaae89ae3c1f4ba2ce2be98b49228fd62fae424a1d590f

SHA512
4d393c3f107ce980baa977b5d1dd2f92cebd4be7b6e86efa76a9e006f17102866803e3043598967fae33b946bda34d561c0b945d1db14ab1f75e9f93b02494e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ed53fdb121fd3ab6d48409b2804fc3d7

SHA1
ae9e7a9805575ac14382884073bf87a95e40899b

SHA256
8e93dad67e2ac7d0c099e356a3d5938016f1af999c5e97f8f99cc4ef923f5a1d

SHA512
7934f6c4327879e870f2c1ced4ec23448faa444c993a0b0497edd236b5dee5ac1890456f8b002ad41545e5aa6714e1aace5188e56036b3ef7799e2652c36f78c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
557993099ce4b7fe271ff3af2836fdad

SHA1
9fc7d8905abc68cfdf3f693d4b03d9aa24920f61

SHA256
f8057ea868d36ab680650ca8d632943706dee69b4fe1855a3bc2e8c562efcedb

SHA512
c80f76c45ce88e86acb74198740493929caa07f5fa727b63f8ffe73c1082d81f9cbab8c8d17abcba160d572f3a07770babe978ec569ac28814e149e3faeeb86d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cc3dfb87f26f68107116f9f2e0229cae

SHA1
b84cdc64ffb0a67d3911381a287c66dd22ab6c47

SHA256
f775fdfd2e1f87ecb50996fce6daf70b61e8b13ffa07537d641e9a45ad561043

SHA512
a948e2f00522d94186aebffa21e7ba59fc94f91e3605df7c6a47a75890a9c00f5cd2536bd133abf3eb63c59bd1fd600f95adc294dda79f3924046dcb5afc2e79

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03b864976eb3d08ede7fc459595cd858

SHA1
0f2aea7ac8a99a8a08cb5f6b7be835ec16876787

SHA256
8a9bb1e55437175f8d08546e67f00bd2a6f2ef61eef5b7f1c9cdeaee25031b27

SHA512
1c0831db6e26d5ea145061b46629c1845256126297439ea3cb9c244edc72ab04bb281bf55cac7c1d551084f4c0101e5fcde48e340d9fd2ee271b0e07161c0ce1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7D5B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar7DCD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit