c57ad9d3087628cf541b39793053d39b22da6cdab2284f5cf6c45063e140a216

Analysis

max time kernel
139s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
14/08/2024, 18:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

974405f8522d47032297c4e3a200f776_JaffaCakes118.html
Size

43KB
MD5

974405f8522d47032297c4e3a200f776
SHA1

88a1257d93b0134fa36cebf90f2fe7b4835dd479
SHA256

c57ad9d3087628cf541b39793053d39b22da6cdab2284f5cf6c45063e140a216
SHA512

7803d1e076098d3bc3261b280ac2e9443dde0e1aba68f488d6076a2d4813cf9232d0c010686dbe198ad784899f8279a0289a5e70782e14e6cad405e126629d24
SSDEEP

384:ZBMIVh/0kL4aVd1K+tHwBMwvKrwGOnw7xsAxKMxZAxKr6xQAxKkx0AxKrwtOmwJw:4e/0+105IDZn3cEAXOme/0+1q

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000f2254d2f827c30eb6fad4624d77d66b8b5d1520317dbad45998322dcc389e62d000000000e8000000002000020000000898795f8e8fe3232d21a829606d69eab4230d6c924f1408cfdff6ae46d43ef6f20000000393f1d7b03b22eaeb453e17d8fa66ed65735c535e6a87f1d19c8ca799ac5aa1c4000000048ba11db89845cd13e8423636a61f32653c80402325c7cea248bf4a8dc7978f653d6fafee560b19f271a9bc1e2280e881444af295b81b2a3d3b6f44277b50040	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a07b04627beeda01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c0000000002000000000010660000000100002000000084421f57232d895747249900b32bd049f296a6497a8366fb9fee21036dfbcc71000000000e8000000002000020000000c945a6cab8ae899b1fc545eece3243d54158dfd12bdef9319f7125d394d56871900000002e54b42e6bbcc6f548438bd6a6ca7cb15dbc066975e5c951e24a813f99bc2e43a7f6571e4813de93a5704e60f4c3371ce45fd7a8b4c1dae430ef136e24b80eec56482fb7312d6f3a9ffa066ad97b54576da2eac7e05c46776ba64386b5b1acc167b3ec9d6ff46dcb2e590f4dd95625603b1093c5930e9eb5c772160e8dd845373a435bd780d1896282ae6c38efdad19640000000ac66989285a7200bac939c40132ace1b3502e13a7cab06c882b917080bab9a1974fbc26ea42b2b85b00ae5894320ccfd7de81cdbecea7edcc2c26e4676d89f2b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4CD44991-5A6E-11EF-9CB8-C278C12D1CB0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "429823393"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2112	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2112	iexplore.exe
2112	iexplore.exe
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2404	2112	iexplore.exe	30
PID 2112 wrote to memory of 2404	2112	iexplore.exe	30
PID 2112 wrote to memory of 2404	2112	iexplore.exe	30
PID 2112 wrote to memory of 2404	2112	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\974405f8522d47032297c4e3a200f776_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2112 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
7133762fa46cb7d21a85feffbb0b8c19

SHA1
d933590a864b61866f392eb1280065aca9b1fc0d

SHA256
797b7b84786fb80aacf9ef30e46af72e0342d4865311cd758546b2a50076ade2

SHA512
b48f7147d23d6c45abcec9f7e862bae4e804e03bc6c31acd3fbc2d479fcc99ba6cf5f5cb20a5dfbdfc2a290a1cf8750944725b9c0af0fa0fdc5600866c681848

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
0f4a011a6ba269be6bdf9b30b35e282d

SHA1
7207aee339b37cd39aa78c86463722f1288417dc

SHA256
5026f208a5be6dfdc0418edbd30672d7f3e3886826ed9de39dd5ddb13ce7acd3

SHA512
67bac59751b7f5011147b110c6378d9fc7ba9674492e60db7706434d1f86df50ba0cfa389a6e08ef731d4fcb8e2f75637cb273c50e5937a2e27f5358f77ee1a2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
ba52635eebca83f3a10bad6717acf905

SHA1
1981a6ebb509993bdcb566ba65d5aa40d4ad2ae8

SHA256
a4dbef0223bd20768702804805feb477e391064046f7ce7c275088abde7941a4

SHA512
0fe3fd5b0cfa34b27bd8c2dba0b13b96632e399ef7aa0b95bc24047f8693a8426bb19b3cd74cef0ae7346103b78c488634d3e1ec88fcdf2d1650ac51a99f16cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
d57f7dcbdd7e67518bd672180e7da83f

SHA1
f49b9b10cab8a2e449ce651bfa16c7b9aba258f7

SHA256
6ef0c0cd21abab96183b2b0661ea633d16c74dd6f165c2559b8c84d74998c63d

SHA512
8de8aa997627b3ce0236f97557ccf4ecf8135f4af0e4b701f11faaec36fc8be143f2203da511f7e44131dadcb1c48623e3f80ecbcfd4c6830fdb724b150abb30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
6d4e32f24a80ccdf7b3ed4ce728bf40c

SHA1
6eba7933a222d7a444d6bc02f8625341cd1d20f7

SHA256
4f4772bc8213201ace8cdfd300e1606a7843af1ecbee0a103a1d3e8908711d87

SHA512
2bc8125a179afaf61ce781331c5f117a8b2a50ea0e84f80fc9c17c4f4565d4d67dee98e20a7e26eb6d26bf0d44d08db8f39553a2fa13da1bf9b81a99366cce00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3c931664383ff5d17b485ab705a7e0a0

SHA1
28304f5042c16bf62cb0c314ac9faa0ad1c23b08

SHA256
866725ae4e3a1b0184c2a61e0802c8b7185656780dba159496591672fb342ffb

SHA512
9d9b9f485c81145c6d92130c3f52f302cbef790f1cb028ffcf49862b3c76a0b8b687ef1e39c5c872a26d3b85d6a5081002e14f9870012bd5ff51af9897da1924

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
2fbadeda375beb65cc6c5e19b003fb38

SHA1
c56bca446471e7dc7e133e6f1d95fed3c358a2be

SHA256
f8a5fc8b87cf238cb6617b81a82eb7057a7b3f9fc94d4b92dd8941941a5352a0

SHA512
74e1426f30be6b89d283fe3b124914d208940b96cef98ac8d3b690c824b23eb6d71e444704204eae8bff27bab1e5ffeb0966ff68402b8e54513962c244bb04b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
64c298b8ec60f0c2be420e857f0e9c7b

SHA1
0009db3b899ecf525f621f25a97650f85ee70659

SHA256
5b1c074857373ed93c74f8623e44a974840a7b8b3312c6e3eb5b595a01235cd1

SHA512
e56d6123ef87425445ec3165e5119a3327181af731c61ea663d86d4b1dee87020e18ea305bb8c6075150592df50178ae2ee5ad1c9ccc926d79562e0437296bdf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e3e335d41aa015f7b9c697d5695a0432

SHA1
ce3f1f0ea4636245479b12e7fbd0bbbfff8534bb

SHA256
b32552766164fa5b7ddc412097f166f86f41e355c91b055e2d9ef59c0923756f

SHA512
ed59d700e8da61e9c8d3443d907798b271d3c4aaf1e979e05bb35da32bedb03985646f3c6eea10457053cd3c411c647b8e230d2eae556df0095923e785ad8f0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3c8c454d335974709c38fb49bcecea5b

SHA1
ba8fbd6ef43ddb3acbee2f1b1ae50db77494427c

SHA256
68e46bd6bc90929ef5c52f59fc976457f4441e960d6c34383c789dad226fd457

SHA512
71bf00ce26a17ee55e19b7d0efaf512219a9cb42a6b00ec472e0979c4c3f6a63d4efba3710625ac21f34ec62d5ee2ee26f084babfdbbec213d9fc9440a7ec285

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
aed04a87e9a17328e5bb790f371e9782

SHA1
116d989fdbf4f3ec2c8dbd17aaa1d07e1c83739e

SHA256
a06235fa346b1e5d06814de7ce5be4878ea732a73fd223d9945d5440a7fe4024

SHA512
fc38f81a664106783e369c68c2a1d5056830b30fa950e56d5d4be85f6f4499d947d9d7deca045d0e224517176a4304d6beaea963ade453d2f8ed5aa60688f7d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3221042b102d2c9fe1eeef0e92aa6294

SHA1
f11a2fb59c760182d578af31f2ff9e45c4ef4373

SHA256
721aacc8c6aa950ac60997228e0b07320afb982e88ba9ce7bb607357e009a223

SHA512
4207a55b74ef4ae5a70886d07887b26487310b71486e424cd08515b989bce8067424d909c771661eae330b879c22fb29e8bbb15a48aa22519099f84f79f6ff80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
5cc2785b70334c6530cef60e20849458

SHA1
438a29a89abce353162b89b51cd6af9dda9398da

SHA256
111814e3ee3a37e39a56c35e8c327f1f9a9813f510df02d578c1aef5e59f0730

SHA512
1b0bdd45a388430f936137fa62e9b87a74b673857fd4f3fdef2fd44c84ffa2bd7453e2dc3e315935393aab8bde926ae38c59bb01b4a30991ef5952a9b9d79feb

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB28D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB33E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit