c1f03d61719b3764f3dc81047aebcf1d2574656d3041152d31a56e7e63baac87

Analysis

max time kernel
137s
max time network
136s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 23:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b5681a87ef478c6eca9695b6fd33a533_JaffaCakes118.html
Size

6KB
MD5

b5681a87ef478c6eca9695b6fd33a533
SHA1

b5cd0b30ff46cc0172f71eafa1912e7cd353eb19
SHA256

c1f03d61719b3764f3dc81047aebcf1d2574656d3041152d31a56e7e63baac87
SHA512

d7cdbfcf0c5b017cb3b42ba11d326f60500d92ec0beb96ce90602769d0af868377a60a2e37b33f32350bf819fe3b56a71b9f73deeb375c04a627aa4199e8f60b
SSDEEP

96:uzVs+ux7YQfLLY1k9o84d12ef7CSTUVtMoRS0ocEZ7ru7f:csz7Y4AYS/EMoCb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000003b6d1dbab8266481591dbd2501f127b260aaccaeb65f7fea9ad9f51d47701c93000000000e8000000002000020000000f7859a0a1f9837433edff2aa6480272cb16d9a9b2e8755be2dd764b0bef4cfb4200000002ff9c2c1911d19595494d10b19e09d56b4317d6583b104a3a3be89a25ef4681340000000d781b34625494667b575cbf06db0b4c0deb75842b4523c72afdc68a8d28cf0ee380df66ad03ff0975fecf5413b8ff5ac0d7551d5278200a915f20eb4c8546c70	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430443407"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 708e47b61ef4da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000dd7538016cb89f7c8d68645ab44e7941c84fcd750667ac74c7f9347a301157f6000000000e8000000002000020000000906ea9d114e5f37ab8ce2eba4f34bf6efa1656429a1221cd78a9bc1dcddb59c790000000dfc7e9dfb6347e2fbdf6f31b4b6777326ee7b63f7d1df306320e0f18d2f5f5e5f434537ba128e08d3be4c11134617ccadd78788b88f3cdf51f3919d7dd93161999f5a2e60f21d313937be56146837f93ebde0487d4cf367411acf58e46e724fe5d3e754a500d3599e6c5e74e79b6fe02940f46071e3282f1ab440c49ee9768f73b58ccd10c1f16c60cd7fee718712faa40000000590e543bcc46d8c043ceedaeea1fb32dc7ecf2ea52bd2de8fa9f8c9ad252043e3eb01910aeddd01904a4676d9a73e1acec70765756b437d1d5d3a4040abcb42c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{E087A801-6011-11EF-83A8-4E15D54E5731} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2012	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2012	iexplore.exe
2012	iexplore.exe
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2836	2012	iexplore.exe	30
PID 2012 wrote to memory of 2836	2012	iexplore.exe	30
PID 2012 wrote to memory of 2836	2012	iexplore.exe	30
PID 2012 wrote to memory of 2836	2012	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b5681a87ef478c6eca9695b6fd33a533_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2012 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b134751efc034293b7d16ca8d5474385

SHA1
f1ec7f6c745c0a39df9979e1c6b691e87c8411b3

SHA256
4277fe82f463d3ca9b4b6d50a36abaac0e9da415e5110b9e03dba8953eae7895

SHA512
477775323c7418869cc43088c6e9dffa92f1c78ea2483108719743a78423a6e5d67b995651ed78aa77a3bbe5fe5161ae5f9406de0bfe898e6259bdb2aac45b5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78d265509101d0d6f993f28442240684

SHA1
504d02be64238fbe349a0ee4dc0e37b90db02ee8

SHA256
afd18449bdd2dd7991dc7851f6bbe4e5d6b7420b7e122e0770f4eef41c41fdc4

SHA512
6fede5999cd33932ce4b7d41586af6156ac4330cfeeaea71200df01a9fd07fdaa28d8c2ce8945d4a6a23fbadd36eb97b33b9e6b39ef0796b04fba17cb514fbf6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8804091ceb9f986820768e685d43ebde

SHA1
4c7d627ed72482a47cc7959b1cbb3361d71fc475

SHA256
f6256b7a77e8c7c1aefd5dfc33e4fea4943361e647605b836d6191e032054994

SHA512
afed9d5be9374eb3353ac3d57a42f0ab344ded8d94a39ffcc6a68920906d4219c3f39cdaf9e2ba54ccbaaf11c6c4661c53cedeb50c4d1c47eda26876bd670577

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1ebb9fb0abdea5193d930672fd927daa

SHA1
aceb8110a939690e02875e5dd7a5539e4b2276e6

SHA256
8c65702a400f1e819d9be937ed4c716f7babc95b4b21a0ea3131a6e1ccb011d9

SHA512
aabb730fe37de45d7d03821dc8b423ceb1020ec02626546fc31d1cad564b4b4aafa0f75eb76885b54578ccf480b5ac28224eb85ecf9708c995b7b73908af21b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2cc96b1308021fbc8b4e0ad94322d570

SHA1
ea12005c2a33efe6f478dffa83ecaeec69d3c980

SHA256
9f0a786e9ffd981c3081879e2826cfa728aa267ebf93c158c30384d634d91a3d

SHA512
08ebaed5c60c2ae0466fef66388dbfaf6970145ce4325f9400afef38e51bb05da7f8b6217dc6bafb9ff5eef435999e1d65118650f89f053fe5b022f50e4333e0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7da7d1c906d102c1d7b9a01f62435d89

SHA1
95f316cacfb7fc058076188e1dba13bd7e6b41d6

SHA256
010bc415f67376b4377af0dc710a8d3e15e691da93afdf49c19ff0e93aed3ac0

SHA512
02c88e16f4c734c61417dd79720dbdee97b93fb0293bbbef095daa7004621655b6d6dbfca97342d6b5b4dae4f58cf09d7669512ee3e90db340cc5f3c0a427e9d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aea36517cde83ee79986d2e92e89c58a

SHA1
4c20c9ddb3d8bc6a8621057e840f92a8ed99a856

SHA256
a22b726ffabca462a28e982c45f120dc0a861f4954dc2dba9bb1db631cee0b45

SHA512
5c0b9ca8a1d42f28caf17b47e630a92b95eb6fb619368004bd7303ca76b49b7075e07b1c5eaae625d2371b22c9fee92ebba511b8211045ab09e0a89466a5e4a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ce40e0299a724e880b05dac5a43c23f1

SHA1
2f1f45662a6d7c05c7862228d11eab34aca62753

SHA256
ef1d6fb77429290d6a836791d11a71810bed85b8bbb46e5ecd757a5679d421b1

SHA512
a89246cb4e864d597676c52dfd21771378517832b7601e1f27e2107be3e4aa181565a0d6f95591f6861ddb929b49f18844bf46790ed1b26e5b53d70db57535a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57c6cbfb9346377f36faf6574898be65

SHA1
9f93f9aeac1dfb41e6cbc29c75ff6a0c0161ed96

SHA256
f06731cf5819374bd7056397b82b321d2ba974c6ec9163f28f95a8114273584a

SHA512
d56aa39c0c114f479dd65d6d633c5da0a8f174a9ce61ed81cca2d062b8a31177dda7ce989f772be7fe16c790982ddb5e8b0baddcf7cc51881524d39ea5fb9dbc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61d769a4ddf0d9364a40d8b3affe60b4

SHA1
821a32356a9ff2d2be85dd69691598761dbade34

SHA256
db4142920ae2ca001121f635d0f1f2e2532b699e40afd46d9dfaf4e4615e0ce0

SHA512
e8ed0e9e430be86378ca9d0435e726e8e97d21f27a7a5062c55f996f379af2305bd2a7779252be75fb6dac6df6522d2b1b4d2a8d8644a2c8a761b6dca11abec2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
74955a614bee8d57a0fc1b2433ee12d5

SHA1
a201be8f36ceb9b22ad6716dedd3cb5ec869eea9

SHA256
b0c643801e5e35d59003afb887cdfd98e56ffb6bd5b75dc0a1935c24e010d96c

SHA512
7ea090eaaf6d06683ab0b85cea0aad9440ba288fdd57e200294b4a3ed35eeaa5249455edc9cc1cf1ef3bcabc365f3dad9eab2d58e3674b30a36ea15c5c948181

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5608152fd939c09fa92f24139d473837

SHA1
99370a873c04e719cadad4d610266fff432ce7ff

SHA256
75e28c5f8f0e4ea20b428a55ba30e4cca36d0585d9b4b8bc4c1b3fde164f3c7f

SHA512
fd9cfd07b2e1d53e0a30926861a20de213349cc0e8026cd681fe95ae329ddaefc8e6dfa5bdc8645711dcae28af96a5f40e2de4ffa3c14f92ab0d4f90dd758f3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ca3be0b4ba9a8808f0e211927ae9835

SHA1
5fe1be35f30794cbf9be26e5829c1621a40369d3

SHA256
4c284b25bb1ad78ce92e3c8039066812a1e681e2cb7b3264633710c4b9b4e339

SHA512
650ffe79954e7f76552aee0a1029f8d27626bee5a19285800078659871ac894f2d54ea92534fd9477e583a53ab502ec2138a905f6a4bb9219080c0cf0c574533

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83d72d4e95f35c304ae62fd2ffa30046

SHA1
2272fb1c43c12d960be410000a98dbddec537408

SHA256
11c0726494e3ae163fed11e30642434f345d3d1e882b0bfd8cbb374abb65e381

SHA512
3c768f0f4dc3c30c60277d7ddc686b08c861e9ef91edb80b8d3aae656e0b4da28fd8376a198a67a1d092056129adbf0a5bf9ca7a14020bdd88075e4adf6267ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabAFB3.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB073.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit