9d55882e1ed3902df86605d4bb4c8376e67281cc30c31410e2820c2c8df18527

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
19/08/2024, 23:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ad0e0c2e55222c041fd93b06e4ba45ed_JaffaCakes118.html
Size

127KB
MD5

ad0e0c2e55222c041fd93b06e4ba45ed
SHA1

81e88a0922c8568bed1b9d3010111b326762832b
SHA256

9d55882e1ed3902df86605d4bb4c8376e67281cc30c31410e2820c2c8df18527
SHA512

dd2495b0e120d1ab83153066cd51f701d4664c3df0ea23d7376b3eb7b7a4da9ffdd71386fc8d7f8c0ece6eb3e410666c0bcbb12e2aac4e85219b275fc7e41e55
SSDEEP

1536:pbMjw2fMk1D3O9Pj2fcJ5OHAOKgLLd96Uo7cZsX3Hhp:sT//Lno7J

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2FE2F601-5E84-11EF-861D-F64010A3169C} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430272610"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0cf4a1e91f2da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb78000000000200000000001066000000010000200000003bb37a3fbd00dbc1626c673d71176847549a1fe56ca2a3e4829b4408d84c4017000000000e80000000020000200000002114d38e0015492647d314f86fc592a700a4b2dfa34324eac9791bfc669d026a20000000e09915c616af2fbf0e30cd766555fa6d5c24d5162ec58defafa6bb6223802c0e400000002fbaef7a5369ce35023368b65ba7623b561b4800eb5e3e9d5fff4890c4427bfef5c6fc3ded2abad8d667cc37bbd34bb97bb53dce8a27c8c71e57dbbcbb13ecbd	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000e4ec538e5c40fac6db2364e1aec3cdf09bbea6d396ea8fb08d7695f121a23e1c000000000e800000000200002000000034e80eadf77bc32fb9382bb6c583c5f354696add25a994bb3a1596010835c50d90000000f731eb45ded040757c42c3d72534434ae86f6057f46f591983791f7a0deea2650fa61d2598b0db24b4cd680b98aad539d6d597662e9f2a5e2762cc9f22b8365b834e44b9b6ba2c11c7b660cf8d011368d50e20819ec01869bc1e554a862e4232f1ea688c0c79310ab8bfd1d2c8750cf4c63d732c84b573be4aea36b6ac375dcbdafaf977692b304d4ea45ca78d1d9d80400000008fb3a575953720bcd470c4922ef76a0dc30e5ae7f01cdb7feb68b744046b84c5044a6f9f0909ea5d018f83aec4aca0e5be7cf22d910bdc397dc557cfd23a60b4	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2688	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2688	iexplore.exe
2688	iexplore.exe
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE
2732	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2732	2688	iexplore.exe	30
PID 2688 wrote to memory of 2732	2688	iexplore.exe	30
PID 2688 wrote to memory of 2732	2688	iexplore.exe	30
PID 2688 wrote to memory of 2732	2688	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ad0e0c2e55222c041fd93b06e4ba45ed_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2688 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
47785a138f6eddc1022e85b1812a3f8b

SHA1
9893b61edb7060aa9b5fdd8897485051756d0969

SHA256
8dcfb9d2fed29bbe102c38fcc86a6ac8434879a72f6ea276a510eeaf72a0bc76

SHA512
2445cbe40332f27d7dff2cf6c3a28a31f41aaeda99a611586100c81c2f4e9c81b3dce5af546c74eda9d71cf8487302b56c6245e8efe4883205e76b67dc639536

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a014d68b349f5d884a3099f8f8e751c

SHA1
7243e15a74ee66287ec0525898023871a70196e4

SHA256
6d93d16f1033bfd10d3b7a61a21563f347f288d5eec4673f19b26d1143678b70

SHA512
65f3e62385ed1f54fd53cfdb389a24e86f2fbdca5b5865aa6cd5d9785e7b78100ee0d256456f4d8514b7ab0d6537831d1a2f2e2ae49ef6f3844bec0e68e0d058

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c88ab63f3c56fd6b195041c298b0e7a6

SHA1
284947342eeb31f5785782e7c0660f55025240a7

SHA256
927712eb164fa8918afd89f24917053f10109ae35aafb8d46e717038bbbd1fda

SHA512
22d532965043ff389543f9b932c03d007ea222cb84bcf02aa51c4d66cd0611bf1b75c8bb858a55337d15db120b418e29434459c8d1669e3d5cfa954c82406253

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
911949d2ee85f69eb4dd03e6c081d662

SHA1
196026816ae4418d8dfd774925b556e52660c532

SHA256
3f32bdb4fa0cb2200b91eaf69db5347234455c5ddf32a5d6161eb17a79efa09a

SHA512
fd85f84fe20c10427b515960278e976bd86337dd1f26adfbb7c6cb1e2288a2bcee0fcf8029a6308ea4a6252009c646f165b921857546d063034a90d6a954661d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f02b550f751e05d41524c7f174cee041

SHA1
436efad1ca54ed35b3abd24fe4be8677631bc070

SHA256
c736aa656a2cac3bc5579b2028005d72309d6a79e4ada0ae5069fd563c2cdd01

SHA512
d43433e154012ca6d70c6183a024e82db3e0a8e31383e6e44e4239c023893d31b0eece49aec6d122d84e80d87dbfd74c39a5064c70ccd6b14e0f51bb63335592

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8fa76b9eb748d7d7a79fe73b010b64d

SHA1
6b41464731932395482008b2d1c93bc3b9bef311

SHA256
dde2ac991ca6213fa8783e1c1202eb9332039c57691a52099c5ad918cef70892

SHA512
8c07042bc6d82ed185c4cdeba35f3a9473b23d0d15c4a7ece0593db7ff1a1b8b27c06e51a05af240f215b82b0e2bfd3ef1a0e9af9156aade2a307a0a6f8bef66

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
43a34f8aebb2850013783b49bbdc90fb

SHA1
f0eaecdc1e7328ba27fb5bb3fc0da5ca5a6ad038

SHA256
2ed2b5eebf3ff3d84466e09d14a2022e74407194259efa17418575dcec22bbfc

SHA512
bb7e5fca668c9b78b5d7195cd88a795bdb72cc233065acb9a830e67805c635e17edc5f4b5f4d118a50bd7721719f34c8fb0626639e82d5f06148f5149672fee3

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD76C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD76F.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit