9eb0f9ac16ddba7e928b50c433118fa7f7c80bfc645d7fd43b5ed7fd08ed6bbb

Analysis

max time kernel
135s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 16:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

96cf14728b99e74bc36aa6f7da0d2ab5_JaffaCakes118.html
Size

24KB
MD5

96cf14728b99e74bc36aa6f7da0d2ab5
SHA1

6a32024d2feafd946f3667a06e3b81a82749b80f
SHA256

9eb0f9ac16ddba7e928b50c433118fa7f7c80bfc645d7fd43b5ed7fd08ed6bbb
SHA512

ff00d24b030910f22df2ea9b0ac0b3b1f5858e12eadd3d8192e2ccb1c922c09e16dd3147cc733a2834f2045a8e0923b5a10d023c75e7b6499cad937b1da761e0
SSDEEP

384:IpU1fSpbOyTShkzqYyXu7Rt4lC3six3N6EYcfEsMkKtF7ZO2Q:IpU4p6yIsdSgRjnF8cf/I/bQ

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000002b469cd25e97ab29eaeab1671d6eafc0ef3068127b684c7410ae8a93c7544c89000000000e8000000002000020000000b8ac5539f4aec650e82e2ed32446d38631401d339f58323bbc3f18047a907f552000000067e8fdb9c17b95bbcaa6e3cd8b0be5a90aebf39df5ff5482fe156ab9efc2567140000000dae58915dff5c39a791732a45e97c677f49f05d9e158a0f5aeaa5f94f42b6d3c7099141f349246776329bff32c0b0a3f86c72ef21870633323bb96de9bce7394	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429814974"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000f8d956716c29c8e1e5e75e775a8f7104019ca43cbfa7c9b8d41e909e61f1064e000000000e80000000020000200000005e82afd4bf52d664eb721c496e45fdc023327a575a2de6c28aff0cfdc339afe390000000808e2ac90613274374152326957c9d6916f4ef7f94c4655c8442bc5f7290e557d97f040034a37c8563731d108ec07caad6f9cebdf42e62694d4c62381c23b35448348793a7103b7c2fc86c608e96c00b491f180e2795695a3b61d7967f7f35a795ac6f46ad17e8bf2006057a93133d153c91f708458dc6a9211ab307e8884bb0f6a2dc6b615ce4da9d698dc95c45819a400000008c4191363764c8e007423f3d0bc5378611d123c6053e6b00cd529544f19a37a6ec4087e478d2e47aebf34ce1582edecc480d6b1c42369522b018f6f1c0d28d98	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B2183C81-5A5A-11EF-B90E-5E92D6109A20} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90aca08667eeda01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2220	iexplore.exe
2220	iexplore.exe
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE
2856	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2856	2220	iexplore.exe	30
PID 2220 wrote to memory of 2856	2220	iexplore.exe	30
PID 2220 wrote to memory of 2856	2220	iexplore.exe	30
PID 2220 wrote to memory of 2856	2220	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\96cf14728b99e74bc36aa6f7da0d2ab5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2220 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7750e8f06b18efb8b492a5972fbbe53e

SHA1
cfb22737b96052e706ff81f2fdbc12ff53bc87c7

SHA256
20e70b04811e9f8cd7677f2c57193903569e55e5c5f8fe8c5218cd547144971d

SHA512
089e4952a33f45f14f29a6fa2dd4e223e8dd46c520aeb62bfe8a4fecc4b95cefeba19d28e3fb560c38c161071b4a366273020aad9aafac3792092858f67ef0af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e27a6e74a5b5a177dd60cf5b3f66cb2

SHA1
812513bac83321ec38871f212ec8850609ea324a

SHA256
8fef77c090059f4e9292a5518e65dff01e86edea2c01767b5dd8942dbcbfaad3

SHA512
67865cbc9b5760703f4c0e4cbc60dc8dcfa47de61f7bf739819535b745b28a32185e147387afd21eda1c9730998fe62f9d951dd679808d9be30a0929337111af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c3182e44158e89998437ee9aa1767b9

SHA1
42b380ce5493cd25395839f26f438ab8bae55a2c

SHA256
e34152f40acba1d801f240f952a03b9f824d838a9ca2e9868075933effa6242c

SHA512
56bcae386c160375501a6b08126b708d4064118bc797d30cbb4d359e3e09d3882f2e7ad4ecabc4e1aae3827db211ecc1b1896848bace4eed133a5e3d97385392

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b8b4411fc16c1ca5e011d5e23ba0aee

SHA1
7743098e84c8caaee6b8307d15c9deabdd7ac7cb

SHA256
36e8eb75446930fbc0994b203ca9e0adb5a88da572ed9406b9496b5588bf54d8

SHA512
3cb3612e3f57a9b5fa90aff6e676a589f4c0d660df9cd0ffd0a3b6f53128630321103f645573369adfdaeb1e4f792a0e43bedd13284bcbb23ae8f7d5cdc4c0c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
045c1d799efead9c8f7e73eac62ad00c

SHA1
e3f59507b297c72e5161361c3fb1b3c887ea66b8

SHA256
3df3f88586cdd4fbb8f78b9afe4a6f3cd7a4dfe42aba162f78489645e4253ada

SHA512
68c0d8b6b2ef0f697f32ebdd091729025b9be8cc6779614b58f7bfc6927a0b0060b189ca3f83bb7e4ba3a4387cb248821ed1da2eeb69ef0d7d9b70c462be8e26

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
df68665a76bef61014d95b568cacfe1f

SHA1
27769ecfeffa5cc4f7c82dec71f54cedf1593100

SHA256
75483d8af4d2d0a555a3b7a89b1052b3600369f95f8e06435ce95a8bf5aa2d88

SHA512
23f5a5b00e01a811e7dcdddafa1c6176f9fffccb8def579ebd652892e4282f3cfc212ac891c275061d9c236710e2b511cd228aa5aa4869a8014be20b0b4870a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3330915f3a2bd4f1f061e06d494359ea

SHA1
91809b5b897cb7949f9dddfe7e20cfaf65a43e72

SHA256
d6b664c4cb7e3f20656713c39e61dc5efd113af3371b6ac3cc14467379a11bd3

SHA512
29b3002da97ba21497221020fc8512bdf3b67f20ba29942ea966306eb5680c717a8a8678a7d03b0a676c83c66fb606ac20dfb1b84ff72d1ca2210f3e5d3eae70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b553d3941544dd8868b2edbd059c0cc1

SHA1
fc7f8c30deaed15fce0711b4d2ab1ea28bb456e3

SHA256
abf2d67e1be50a75490173528f5939841d2dfcfea00610a68228a5e149ed7798

SHA512
1cdb3db996bce8d52e3c87eaa043b6ccf41f69d1167a8ddf4e03ad5265520679bcfb7577674ac353870861058abc494a823d6c73d878121f94398134a9729145

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
582c9363d73a529117b05e8a42eb7af1

SHA1
09c7789924405c9f755860b7967fb0b08a60207b

SHA256
1a144c36fbfe2e9ffee0d972a05a1d5845cc334b939fe5defadfbe67b4bbeeab

SHA512
240cd32a7bc3b852503293eb32e07d48a5af8dbff2f0a3939140fcd32fc163324005161962c3a76e91193d3e155ed3c17ad603c707cdae31455716ed5e7de8bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8edddca5bb92be9ef3da51373c0aab43

SHA1
311d68444b327f3b2c1c5fe589dc4cb7dc33c33e

SHA256
f47912472b96ace438057c3f2a49eece110792ed5cba8a68bf3342829d90ee6d

SHA512
9275dcb1f8637e1699a7628a55e9a494ac00588d31f9b7dee779f2690d1ca6fa99123a3a1a7d575fc45693efb1cd3bb78c314e5fb0aad5ce519ca35466ed9ea0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90668f0e438d9511e3df0694eed84bdd

SHA1
21b9aba4eaa6d2b0e37bc4e7892905aa1e72ed9b

SHA256
0cb505d8b675b9260a621b62b29a3749d6e37e3ebd62e33b81f1e3a464035b16

SHA512
004557fd157efa03e9f484691280a2cad510a9801051dc5c325a88fcf287c17dc5b58a2adfe84f25cbd2867d04ac06d0538981e2a8cc639649637b9b0ff72b86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4c1f9df02cc02f4a7768f944187720c6

SHA1
a696e7a2bd8e7c611918c72ea84123ac15e3e5b7

SHA256
8bd82d7f0f66e10eef449dc383f908c3e4d26d0b2d2ca5f2424ad57ba4839ced

SHA512
ca2270c7a706e535ede8724ade0952653aa9783dd429a021da75bd46c0469d148027edcc70108ff62caef22e3608d625db1916ab77ab549257b08192595f7378

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3629edd2c5ab3dac621e20f06640ff1

SHA1
56a9290c0f7443caf3e0d791b441bd43e05e23f6

SHA256
3dfa6e6eb2badc94eaada436310637ccd17fd5eea5e3df64ce12474836618820

SHA512
23e4d19a58143d51ba7da6effb483dd81f584696338a0651453ac9a0dc4964252826909fab78caf5b335051b83ffc4075ec4b84d256a20858970370fefa72f85

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1dded1a00ce5dcf03881d807f92afc13

SHA1
8c2fe27efefe7f834863aa242f1c4cd0b245aa55

SHA256
53ec9231eb0615ad759e5087d43d3970b25cadb31f3541660db382055960fa90

SHA512
d7ae39de71741a647ed4c0c18b911bb550689c28be068de67241cbe6e7dca94e61392969c39758bec5d23a12f9d8819a9ef45c55648f2c7c57fedc956e3a5271

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bac20268e71fcb6219f7092e4656859d

SHA1
ceca7064836465151ea3057d2843025a6a22d514

SHA256
dfdfd3aa2f4c17391912e0116e77fee8601db45ea8f7742cf7d612b30967cffd

SHA512
517c804600198437c5bb112560d7648c3ea46b7bf85e5eb8df4e1fef542fb6c13710b501a99c72f6fc02bb598ebb93b41a05585fa4aa4229b365b4adb63fb8a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2011.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2091.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit