4819563d02095f13293a51632313afb8b396e85e610898102c5903d13a8d5b60

Analysis

max time kernel
117s
max time network
129s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 12:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

962d8bafbfc0ac81eb991e14d434458a_JaffaCakes118.html
Size

6KB
MD5

962d8bafbfc0ac81eb991e14d434458a
SHA1

55fc0028753d9f682a249a09f13e3d6993c2efd5
SHA256

4819563d02095f13293a51632313afb8b396e85e610898102c5903d13a8d5b60
SHA512

ef4ceb902e41c2bd2eb752fb2fa61b2bbd24278a5097d7259e65eff1838bd1a07e97213937302c30ea1e0fd743c5f769ca3427e02e5819f27e75544a3c7a38cb
SSDEEP

96:uzVs+ux7HOLLY1k9o84d12ef7CSTUGZcEZ7ru7f:csz7HOAYS/Vb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000399bb5d6bbaf583a4e99bf51403b01f07f20c9bb0388c9f43b9a92588c392f64000000000e800000000200002000000047629a2a61a299c3b3b4e648e3a1cdf465cbc81c03aaf92cf9c54881c91433db900000003bd442360956fe290ce021a778ace2370299d122e3f700ee3d35123ff0e174d17f5c18b728895c388f00043ba18a8c13d398a8ee7a793ea81f811ba8bfe33d087366deb69876ce4301feb3b3147827829ebc02e39e363969a68783be9cd3b0733419ef53db379a30bea4ac0c46ddbe149d506184bc3c3d071e4327117a0b4776219f2318e6be10c9ebb4345075f620b340000000170a4cba37bece41174ae7981fc8decd5a52523f34f21d58e9c6d291a4527728bc02a48dec95ceb54b34b27c137144c95983d30ca8daff5536f946df5e106dbc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50fbd20449eeda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429801868"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000006a977d50ec16a66da3c2982e7b948e9eef6e7c6e7345303b0aa99a1e382fd908000000000e8000000002000020000000a40229764044a4c4de950270d6544a53f271a78a0197129afeab6db68d02638d200000005e76dbab5c5c371129a6547369cccf49545e8e30816e234970e6099fb4cae0fd40000000e7be6cd3c67dff1206237e6cbfbe528c77339f0ff72497d95b0215113dd78cf7fa31fb96ff0b0a3a71d2e25af25b71dfa0e38a7cbeb1fd7a6130bc7a20e22088	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2E4A3701-5A3C-11EF-9E0F-4E18907FF899} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2520	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2520	iexplore.exe
2520	iexplore.exe
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE
2300	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 2300	2520	iexplore.exe	30
PID 2520 wrote to memory of 2300	2520	iexplore.exe	30
PID 2520 wrote to memory of 2300	2520	iexplore.exe	30
PID 2520 wrote to memory of 2300	2520	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\962d8bafbfc0ac81eb991e14d434458a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2520 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65375c748aec27db585b43b1ee670817

SHA1
542af5487d4a9175689181e5808fb95bcee26b71

SHA256
3fca944a117fdc42e100b3622c8b654790f207864160fe97a0e8d6fca0bc6967

SHA512
33311e74329e60ffbe5d84efb287b284d0983e006c63edb4560d40de4f14b97d17bc9823add05c42db76889da302a7aaf76a5e58bec885b16281e2b7550ae665

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
adbe7f62243669fd39560d823c810ab6

SHA1
488a5d9539131d173a2c5e8a031f33d3afd82255

SHA256
a6d7d6d7c305301e6cc1f27c9141d3ae029996a6ea4adcd67a515a689b9b1f54

SHA512
4c6632e8c17fb406a9dfb3502b08b8685882e8b7d34d95473d27e5a09d09334770cc4bb4dcb339670d3af1f1d4d117691892ce1327ead14c4988214e707f64ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
92a823de79f35c2524b342b1b1a8ace0

SHA1
38794fe9337f8964ae3bf189b93f9cb75a583840

SHA256
0415bc00a81510bba6b2518f9e6f93c06d1b768e378f96e2c6df3552772e368d

SHA512
b99129c2bba0ad28e04f4a69ef3d5b7daa404a327b5ea2001a7367df8a3605f26eddc9c8c210b583d98bc61e004b2a781bddfcf1669a4229979327ca8039dce8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60cc30d44c1848c405b47d285d971a27

SHA1
3a3a65b5ca0ecd1ba216bf7b5958ad980d69199e

SHA256
0c33f516920b50f73880f3e05b8fca4a767ca93855628b8c472e430d86a611b8

SHA512
a512963388f4f1e514de8628d12f110b67b1f0b7a87978301d54698efe73036dc20ffc70537f68d3f09948a82893fdc02208ebc903df396943f9aa248eb3ff01

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49a3bffc717d64a9fc2c7a2df1536154

SHA1
b2faef94d12bcec824771fb0e0704ef3c608b1df

SHA256
01e101f9a793355522bf930b4ef9e01db028c14d55fdcac1dd64d60636a426b4

SHA512
c83fedec38780462f067301f0dff6f70989dc2c2ed929619f7bf5089e58b46ef2d0774477fa039bb4352083a40f7093b95bbe354a2635a19c7b0ddeb6654d324

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd351eee653d64fbb4abfda610f347e5

SHA1
b1d8d905a5aaac351cdf5af692db5dd9b1ec69c9

SHA256
06dd822942986b26d80e64fda16e4770a0697756978b94cd9705b190733850b4

SHA512
99ee447ce01c2b2146f4e4890e5cc13b7a4c5e96e94849976d4c0d4da1c65794c22d240bf4bafe7d571f0f612633a49e5f371be1cb1930ca0e57c86460618b48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac947e71384b031f8f4a61c6b61688d4

SHA1
c8b1371287e367adb6035bd98b5f6231572954b3

SHA256
a4ac9c8a1251a674cebb2f8080b91ce3fee973d14a0c3adca879b38b10416219

SHA512
106f30940f1a432c9d32ed8b55f49c01268a71ba57d5da5afe9ba99efd412e348c1e25c00ec1ccc518101768c27b9bc05a4b8ddfd0fff357f53dfcf299763140

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce85d9271cf88ddf516eb07debbcf27f

SHA1
d92277c5cad2cafc708be032bea74cdc9dc91e42

SHA256
a71355e1682334a8f19d4bb10f792a627b8de2ba663e7e5a84cf8f62f11314b8

SHA512
02ac53d584f173c59dfd4f0c34e65d4e485866e6a1575011509932e07429fce7990c08fa30f36492294ea87ce12200869d6bb31c42b7aa6bec62d285baeb86dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5fdd2143947e95ee6d35671800576e30

SHA1
c32f50bb85441db91fb98323b8e4b6b212db1590

SHA256
a0621a7e370fb424567354a65ab8eb773e965b463f2bbc19f0e5d80e7a7b9c3d

SHA512
5f55f9e213c6d582e45876ac92dc01dd27b4dffd0fe180924abebfffcfa59490582cf91cbc3806196ac1eac8ba4a0afc964aa7d069b15c997c4f859a2d51685d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e662f4c34caecd8051a712052e916cff

SHA1
c4ffe56ad6f592e239b655ecce879fc6bc5df95e

SHA256
d937191e8c783639d8fd6e9d0a2865ef8bbee409ffe2f8a57005639411496ca0

SHA512
be239546b74474f8d99d38e686c2b186ed427580727f8b02af3e62cc51fcdbd0dcb4593ca9cc23160df14c51a81a10dc4c23721a235ebc38ff16d7e42ef628a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9020ea30ca4adaadcae0b17e95eb8723

SHA1
e4b518bb412cfa2295b8bd2214cbb5afaea33432

SHA256
35081d9cf5667132c0bf1d22306c0b6056f679b332a4ee3b5105a0b86a05d77b

SHA512
d0b66cbf00235d066917abd4866c78a21521a8cc597130ce0a06f2f772327ee568130b43bf5631b1aa1bd0998a8ab174585e2954dcd444d97b71ef43269cb43b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
06a23069c30d0d8dcbf77c6955d9a8bd

SHA1
7711f8465fa11a42494563e5bf58b4016b9b376a

SHA256
bbca9ecbaaf7d96c0887f227e414f0d54c78c2894d15d3d7c1d2af3e698217e7

SHA512
d51a1ca4ac9abf61ab09dcc99c27cc808117c1287a2863c7a7c7010a335a7384ddf7079f247177c0d52456efbd37740534a84011348508bdedd1d187f8f169c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
489393eca15a42e1c7bf63c0af8cc449

SHA1
4895129c4f06cfdfdb5b1c3ea3a7f740ae0d08dc

SHA256
4a894da28a21c84c44b9ca70194d589b0bd3c2a62a328cdb1504a0b00abed10d

SHA512
d29a8558a459df521bf1b9fe55b700d7e5b8574cc543ea8916ed1bc934d2e32f4dcd5e9bb632d544b421cc182f73770939096f5fa45679f2252d4a2b17f9b703

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
621662fb830b80005fc8d94999baad36

SHA1
3d8aa3815ca8f1a787a0e72edc2fa571153b2447

SHA256
d980aa5886557122719a35f23eaff85c9a6c0db5d060b7d027799dcb4cc1ce77

SHA512
2e5aa7997a16be5f93ceadb5973b3717814bc930bd12c2ed070f16b57942ab831c3c819e9d1ae42780ed3f91df1339ff65d2da8e4bef748aa5b93d0b8be9a1ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0ed55c9eb06fc7dd1a79bc73f56c9d6

SHA1
8776bb45ef583eea6e4a5d3e5b3185e288101e35

SHA256
de4671d9ca6598b755ef88de0415bbe98aea38112d89904e6768a935694419e9

SHA512
fcf19526737c8af6b03138bbd015707d93b937d8256bc2be27f131c50c54f6ad30baa103b0e7a04f6acc5cbfb8b8edc95f71464659b2807dccb2b53745727117

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cd851d4a2316e27ea87383288d43179f

SHA1
7b9f1f99fbaf61eb5b0385f180e44a19a7c42c6c

SHA256
59a046c34d08a3efac2332dc42b0d8622963ffd15f9991a974f2bba8bf316b76

SHA512
91ee0253726a416b877ce0c70a0259d87bc052791d9786a97698fef9a1200654351e742babbe86b922631225987c59f48da6c75503ced1068468a2a870fb783d

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEEA6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEF54.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit