eb825d7d598d4f55f0b74a7df790367b3984fa10365e34f6cae54c053e74adc3

Analysis

max time kernel
140s
max time network
141s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
20/08/2024, 18:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b06fddfda2a5ad8c6f29810e8ad25a0d_JaffaCakes118.html
Size

18KB
MD5

b06fddfda2a5ad8c6f29810e8ad25a0d
SHA1

cb4ebd9df7034357e5b75109ae026c19be82a8a9
SHA256

eb825d7d598d4f55f0b74a7df790367b3984fa10365e34f6cae54c053e74adc3
SHA512

54f351b849739f090353eb86bfb1072a282d8d13cdc461468f6a8c1c8958948e9a3962bb7ea70d0fa844a93440bd8e369b8ef7d6a481f3c7628a191a3d8bd0e3
SSDEEP

384:OxBWOL2F4nerHG7z1yscuZdCh+SiwGDO5yH598g:OjWOLverHG7Xo5yH598g

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 703190cb32f3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F6529291-5F25-11EF-A17A-428A07572FD0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c9200000000020000000000106600000001000020000000c6c340a08eb83a4f2fe0d141aaae7ce328d8644adec8036a71c1027625146228000000000e8000000002000020000000fec8a8ab202a13f761c134b9913ade143c4a84f1cb0bbedda9b264cf4fe540d220000000d537648726b15984943b4cbae05e599583d874c42c49c4c92e48733e91e3395a40000000cbb1ea14689404b14e83706cf3d9ef48b04daeb2995a3dc35f6e213f87208c8cbeaf353ed3a44d28ae2514e6e6940ba36f45250828a0bbcf2a0459280874f319	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c9200000000020000000000106600000001000020000000d48ff9a900635dc230fc18b39f26f18aab3b4e7efeb323f5d79a8da10366914f000000000e8000000002000020000000996e1c9a392fb7223e59aa0c48a5459594ac0406bcdca750fcf4d6dc2a69d6ed9000000098b37569c1d8dce9265335904e4ccf445405daf817cd3d1dc65366c6f3ad8dd6cfd521d1d1211aea6f7c5ab7bfa9f78dfe7432a1952348ddf42a79cf54cfeaf4a1c55141e234df1b12a457d2989b44fd8611c1ab522e89767572e22838140a726363c6aecad2e45e845981939bf10a5f6394618c1823823a6a14d2bb76d84b095fe6054e19334d72b1649548bdda3625400000008ff00fe21bbe310e4da01e4a539c6f7356da68a414d259ea486a191cae45c563b47851fba3bd66040c81befb2a346c66d28a30f07922dc8fcb19f3c8fd3d7a51	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430342081"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1916	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1916	iexplore.exe
1916	iexplore.exe
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE
2680	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 2680	1916	iexplore.exe	30
PID 1916 wrote to memory of 2680	1916	iexplore.exe	30
PID 1916 wrote to memory of 2680	1916	iexplore.exe	30
PID 1916 wrote to memory of 2680	1916	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b06fddfda2a5ad8c6f29810e8ad25a0d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1916 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd1e0534ccaf71ed46b70d72ae4be563

SHA1
65c229d74951c6ac44f7f130b3ab8264419733bf

SHA256
f6710573bf60089c869fe3b917e9cde7d2f80a6d5fd3226e319c7ca4f59c9e6b

SHA512
5c3ec7aea4d2b8bec20d0684fbdc6aeee93d461db4f9a5069aac8710a5d111cc657e4eac1b04c39a087546300604fa1191282480a42d60689484ff9dfed2b034

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74bb11666813388415d2c8ba498a8fee

SHA1
a9b64ecbf3528dda7f72b1cbe3d962982d62eedc

SHA256
ca427c544552da16cdd4d3a68db21ef2a12e055abbf6ebea2730444ee2df9719

SHA512
d8575601d9b5a0e4529eac042044bb1a4f40bb0dac8f6fdf61f974e2e4127e553932540684641f884fde49f64668fd43982ed098078205fc54ef2e6016029caa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9fd0a1f1c6bc0f42feaf2a89f526139d

SHA1
5366ce9c43459881d986b87fb6523601899fae81

SHA256
678cbdfbdafc7a2e47d3ed1c80f19b0454973787c211193623accba7ae190590

SHA512
55eebdf83ea9cbefb805210f24a7dfea9233ddb0487b7ea4dfa023bac1eed1fe263eb398c44279016f42fcb53d14abb3d867d004dd3a1d94417b2cf1ccd5c272

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f97c1c7e37db7b20f49805230f5bff0e

SHA1
ff01de8eb1a1dae1d910bc5e5c1b4c3c7cd6d9cc

SHA256
870703e88e419ebfaaf48cb9e508b102915ac6c7312b4d02ddfb686d23755cee

SHA512
abecb3ef0183ae7ed3e8bb118ddef553def923dd74de1475dabd540a33befca4cbd583bd8f550b9703f74dc1919c9d31384d2c57f771c484dd9b39d95f59be17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ec725b4c8284a385ad65185a2e7cf824

SHA1
ca9e3c88a56f9ee4d080674562cf4c37bc4dc050

SHA256
b6e2024942ee7ca273b4cfd298691c40f280019ecdcd261d3702cbaa012e1a09

SHA512
81816f44bc0cb2f4c09d0ccd03550e6bb552783c2df447abd5d66e8256284243241a71221e2c33b8db9ba55ef4db4f99983b5c79bc8a5015b0da136d392937ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ddc9ced44b90280bede0b9c7cec1029

SHA1
59830e9fc6a4856349bcddd8c4c0d039be3cbd2f

SHA256
6e062f2d6607b98f610f9068ca81eb715ff7743a1f6edc533b94d63229198400

SHA512
88af0f62b96c58f6dd8390d4850167b75f3c1a5ca498632d03ab8b91f65c5a26b80cd9ecdff26eef477789d96d5e8f4dbfa3e6b8671a2929b25657eb6554b9c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c1d91a1dd3e897feef3bec0a3c2149ab

SHA1
6af38afa04dc0c1b0eb14981c0e7b943806a59af

SHA256
a0466c3ed1b8fa168792e535173bf6b1de49461ee9bd6d290429954d14428ab4

SHA512
b0432a982279b5cb2afc49e0df753d6e9b277d34544fc7741153ba9000e4de4317784bddd31ad54127c22bd3291ecf526f90a7b259d59cfca0e6b41bc5cc73f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4aaf01b227b844fcf1b0a2d2269386e8

SHA1
2808e37313620f6158403faaf19b7bbd2565bb32

SHA256
272daa3c828dcf09811ea3f78e540af40a2657a760a35a5d2e26bdeb69e1c6f6

SHA512
c86a62666aadb5a41611eaef17dcbb05dcec8fd40166bce6c81c97c89ef1dd07ab9d1ca022bc5aa27e6283b06bbd8b586add4e2c634974d3a80f38f8a8c059e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
68e9bf5a99518006d2f40e0b9ab19f04

SHA1
682face9041ace09924e623ddb371fdac45fb9db

SHA256
2154e1d75418b7d99b8278ad0dd10834c2315e2f29a899fa1106ceaa8645d8e4

SHA512
a24d6bc0d2cd0b567880844995e622f90100a632878e223dee159c69dcd8de7b80ed5db02838d721e1d6b4c24312fe08156bd2c15068907520cb17df82c32761

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7b0a4011c513fb22be538a0271fe2d34

SHA1
366d7596facc39918a392d19252d6cd7db67ed1e

SHA256
0426ca72e120325eb03a500e08f276fca6426ece0113b0beac10d5ae6c4e7259

SHA512
529d8a032a31b49e0bff9181b13cdfb98f7b297cacdbc92b7eee591b5c1956452d48ff097f1d151bf559a8f57ab937e6641879b46f5718fd38547efa2a7ba01b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9aad7f3eee950e1a65346b21f75911f

SHA1
ea6bf40480104532af90ad37367623d2a2fc58f0

SHA256
7ead29be80e38ae4d386e8542061070ad36fc226d15321aa68d202ed51c73560

SHA512
71a2ad0ced5d533ac556da032d1bb087b9e62fc0883b501aeb025bf5b961a42a38efb986619658708c5f29dbcaaa7976f4c96b905c16d9cbe0c75b7925fdd66a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d93d4a468553e0b912984449ee712208

SHA1
b9311774212ab5c25c5c6120fb6389fd005775eb

SHA256
274f1e86596e15f648f434ea0a8a007908b7fe7040870224ab8f071596f389ed

SHA512
e4a15dd0960d16e8b81eec1aa399232e001f8266606135427ddeefd98303f7d182055575fd67d5e799f7afed77a0ddd61029c89a650ac5ae25c12b1d431d929a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5774.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5776.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit