90a635f44b912feea67b43e98687859e7e3b2aa5e81c57f477a87ade3433b6a9

Analysis

max time kernel
68s
max time network
127s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 18:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b04fc93ecece7375b529eef29d23a906_JaffaCakes118.html
Size

53KB
MD5

b04fc93ecece7375b529eef29d23a906
SHA1

4ee75cd8c47d0c4ec403eb6c6f778f66a978eaf9
SHA256

90a635f44b912feea67b43e98687859e7e3b2aa5e81c57f477a87ade3433b6a9
SHA512

27ba8b71c14b814f5eb6a3ac3a1726d0077802c6bd83658a826be1804211adf92b0f93c7925590f5acbf83dfe1889b6f96188bdbfb517e57c121bab8dc268c46
SSDEEP

1536:CkgUiIakTqGivi+PyUqrunlYy63Nj+q5VyvR0w2AzTICbb/on/t9M/dNwIUTDmDQ:CkgUiIakTqGivi+PyUqrunlYy63Nj+qf

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430339702"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6CEABCD1-5F20-11EF-BC3E-6A951C293183} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c9200000000020000000000106600000001000020000000de44ccfee30922396bcb087e0c175cded737306925f44ec9ed146617eec48290000000000e800000000200002000000071cd6a2c20927c1d1bc663af3433030d0721eb37b0b37c73dbc1fc0251854070900000005529fda4db6221d459aee8cc1c2400dca65e84957095ff63e529b0718b88b67b379a98a4b72ed5dd63ee9e5c3a5eb77eb64e8fcd5e8b04639b417bc189b45b542ae5e7c55742bcd333ccf27e2259be361264f0f7b0a1ad7229ded62309db27b459b39bea32330421ffaa1e92e72d62dedaa1895a3ff6a5a2a7aec5d023e51c6b7cff1f87c7cff5fea760b54ec71366bc400000002469bf9582e68442a8bf097ca15c7b75ccff1d9d574e306ce5ebdb14a81ccdac8c7eb614197bd11470f26b2b17da0d4b7f3ecd81541d64494a77a0234fa70a86	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10487c422df3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c9200000000020000000000106600000001000020000000c040edde434cf07011e767c0e4100677b81dda1d827cfd86f4e7d497ee1120fd000000000e800000000200002000000013e99812fecde5e869d99cafda56923849a171dde3d2913447b459774f495837200000003c0af2ba833e87807994f0294e28c6ac991b79b933fca0b180da0d4f63f592b840000000c3a2fb45df39e7bd0886c96cbaf4f5b8cc68a6831c027adae05f4f349795b1e5c02b48b9a4fbdf1b0d1abf680cc0f210d5646a6127143910ea26e7260579884e	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2416	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2416	iexplore.exe
2416	iexplore.exe
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE
2476	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2476	2416	iexplore.exe	29
PID 2416 wrote to memory of 2476	2416	iexplore.exe	29
PID 2416 wrote to memory of 2476	2416	iexplore.exe	29
PID 2416 wrote to memory of 2476	2416	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b04fc93ecece7375b529eef29d23a906_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2416 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c3cef755a7be5d5d1905bacb543823bb

SHA1
c9725949938429c21d0847e57e24ed87615c4028

SHA256
465642f4ce8911afa28b60f21c766f95d597fa015e78852570e18609eb38f810

SHA512
bc33d4b22697407b2d25eaea4bbeb943c63c6309cea9f452bd21632c844342d2fb594088d8f37f1d1672db49d3314960275bd933d7d81aecd7ffd7cd66991c37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45fef9175bf4ef3fa0a70477b11580b6

SHA1
e155b1c727d5d059e48c7e7bd5f3bae2a5265f8d

SHA256
4463a26125d113e6fbfd3ab2f2087fffce850dcbc4f8778a0fcfa228e273d207

SHA512
60e7c6791154a6f3f8b21d7ba4496ca9150a4dffd16343379e2ff837567c88084c461e77b9d2c831308efbbcb488a4a5854a509f7f4d67047bf10da0f722359d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
99e8cab30ed5ab8ee05dd3829e7c8fb2

SHA1
d50f5f63d68181d2f4c37bb46bbb86c4e99b3a78

SHA256
7fa0e24877578f5679a3881f2d76b136843500a1aac15ac8b61a8c5732bc6c02

SHA512
b0d252cb2f16c88f6377d9f24be9963d972dc92245731ee5717f7f975ee129d2ab2a93e427440d7f43964b8998ae371c4122b25df037cd0713aaa74b00c23a70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
871204422d6748f760344c9d2689ec8a

SHA1
79e5393fadbf643e9c049c8948ecce249a29c76f

SHA256
a78ba53e73e93c7e53d05d6d90aeb0ce1333aed3b3d824cf5ac447905f955186

SHA512
b469be2c1e1337f8beb7c8435956c8a4b568c894383841926ca16ce95685b8fdc9c8eed86df9981258e8871021e529e7b6a1ebf77a8a809d9a65025f6f9776c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9bf4b90468d693f8b3d8f80106e3393b

SHA1
dc76e673db083cd9288dc1ca33d5dac4bb21cd07

SHA256
a161b2db41c7ffc3b837de742e0d72601acc5e2a8ed698e58b5034489e14acd0

SHA512
71784ddf4021663cde5ac31df81196eddf8d58dcaca36dc8a2cf98c319d5fa208265ed96ccca4dfa15f14640a0e6643506172b8e1efceb694197da02116c5731

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9cce01ecde917b8b3ee9ca07250c1495

SHA1
89ad929014b7f3ef5d2b61b4d3b5442b92556d88

SHA256
51eb1ffde1de15e336862d191f6241b6c5697dcdb33caeb2a478d4a2e2648527

SHA512
7eae6cc6d9739a6aaa7deeef981298257be36a0a4db9e5cc9fa8ef4c6671af6ad42f230d89ac355845351cc85fc18400d83d733723e31025b40ea60bd1f8e34e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3cb53a93c462ba9fe83072683a30d5e8

SHA1
44d6882aaf78427b816fc8c7bccae0d5ae81ae8b

SHA256
2265764619b937a9719a8f6900eb11ef48bc3d06aba8014e9759985c9057b7b1

SHA512
2194f4be0a88f6c7a40721b1736382dad38d40aea24c725754afcbdff2c5229fa6ee83edfc8d99303ebffdc4e7fcecb3db20c217cd4250d9d76f76c8379f9d74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f93e6e546464fecc0afdcf7723b682c8

SHA1
e04c8e0d1a8a487a1c2f58e8c2ec1434460e8bac

SHA256
3fb30af09e8ef561850308b144c537a29f9dc019829b22e512c62d4245794ec5

SHA512
c0a2114625a2cff2ab03425594b0092274d552468ac0ffc1d2e15003abbc82489fcbe8ad9ceaee62889ed3b42f93b32c75a62c9881eaee76599c3ca4e199a0f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b9f256794d789386e1c17fec0303e2f

SHA1
1122f24a7d5df7c6b7cdb2de48f157d09ccd462c

SHA256
18fffef35247546441985ff7a220a5e8a7424e2df55db29bf9e23beb45127f15

SHA512
987f0293337ebc9cb2945b817d5f7ce05ce67a3e952e05fa7defee4386866c8d6154f781d6fbe19ca4cd9e43100d86edb5a52dbcfce5ee1157e362276296b801

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f1ea60fc22ff7a6b8a1bb39a1e71eb9d

SHA1
5ba94e11cf6785c3a547655c94a580735634c93f

SHA256
bf6e3cfd68883883cd6eeac613c008a1fe03841da2e9ef8e27c31c63decafd2e

SHA512
0a169d815a3ed7d125caf0a125f1efb8bd3445dbc60926e6efeb600cb97e0ecff109a75b4002d543ee2290b0a20f42a9b5ab35d62435c5640deba00ff8c92649

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a6ac3d658b0f9e8ac8f8cf101d1964c

SHA1
80e2552d26afac0e0f96afa06357fec91b2d7dc8

SHA256
f0d23067c6dbd8cb9534c7dc744a298bc43c4463ed2a6067c89799ab20a6447e

SHA512
1f7858f3685e048d2e9d129ec79e16e56c28a34d9bc8901c24070c103213f6ae267231a03a810596bb8eb3b7a90593a3360260e61d4aeee68944863e285f295d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
33784898fdff623f9f11446f3fcf09cd

SHA1
6446601f8fd09f6f3e0bc90f76f81de2e326a7f9

SHA256
28854ba3bfebf704f28b9d770840ff8e48205b5aa76421c4456d0a48e96fd1f1

SHA512
711e14dcc05ff7ab5d12be36c4c60ce90d2ca382ac3b45f695bf06b2a46e836d6fe30eeb5fafbd522cf8e288471bed46aaa3f784a3bc0580a44333deb0e26344

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6GL24G53\style[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab3AA2.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3B23.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit