6e58aa726d53c2125516fedc04cc4c685454638f23bcbedfe747b04ead2d8444

Analysis

max time kernel
132s
max time network
146s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 22:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b55a4d8ffd6eb8c0c44bbeee8cae5fc2_JaffaCakes118.html
Size

78KB
MD5

b55a4d8ffd6eb8c0c44bbeee8cae5fc2
SHA1

cf9f898d8c556b4127b71ddf963a065a15b5cba7
SHA256

6e58aa726d53c2125516fedc04cc4c685454638f23bcbedfe747b04ead2d8444
SHA512

ea7c40394c6c03845cb8d8c10e8bb18f455f7ec107b22ce808f917c065fd16b7d993be2bb2f73d179a7b5b8f1c8039826f47862029568d10fbf835396e0a0793
SSDEEP

768:CVh7ye2sH/MXgyjCKojBVfuS/7ouZrDIuKVyGsaMWxS+upjp/:CVhTbBjR

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{609DFFB1-600F-11EF-AB71-E6140BA5C80C} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430442333"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2304	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1916	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1916	iexplore.exe
1916	iexplore.exe
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE
2304	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 2304	1916	iexplore.exe	31
PID 1916 wrote to memory of 2304	1916	iexplore.exe	31
PID 1916 wrote to memory of 2304	1916	iexplore.exe	31
PID 1916 wrote to memory of 2304	1916	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b55a4d8ffd6eb8c0c44bbeee8cae5fc2_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1916 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
75e384aaf71098196c907717ec6cf4e3

SHA1
137b21f8227f112964670aaf8dbe07d811796369

SHA256
cea7f8fc25ab50fb553fb0239ef25cb399dc1c929462b52e49328ebe1f9c5ea5

SHA512
d7c8fb15859a370debcc7969d59df2ee7c51fafd36ccf88e708e821e4deda3bdb16e036678175c0465bd15cf4bfa6fa900c3d85446bae0d53609ee9f14afdf82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
96ea4a6a6b85a91b321104f105eda8e7

SHA1
c5773f167bba916f74f5b2b2fb17c5364c0fa6b4

SHA256
4f3c981c5db17d01a51feb71404c56c71ca8cdbc62a9f72f0a36470e7b7e528a

SHA512
5696be52964a750ef1e8abdf4ff4a222cd62468d914ce07471846e3ecf69c465b3a17f09b49f74754ef65d33fb4c6d9ec65a6696c954b2e0725e2f64c3299f74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
594e8024ae8366fb1d87352273638c39

SHA1
c18bc21e1981336b574b8658b6cb52860efc3f57

SHA256
8a3daee52b3b21021a13cbc89a1cc7e48578deb86be0e864daab35732837c6ec

SHA512
3e3e5ede4726438d0af4641959ffcddcb75fa4dbfaec8fdc5d0d0d5472971a4cd4afd27abf0115b443aeb39d732b5b3c185c0455a6d0e2a95cb41812460998cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d992d1bcbb9026820ad4af6dfc276d1

SHA1
561fa4ce3089599b1442d002efbc30c22af12b1d

SHA256
a8e8e1ff94c69ec10fc0453ee7a0824b30be188a7e29172fef73a89b4991825d

SHA512
64ee03400504bce72e359c959f543dee973e0e44173c58ca004dd7d0d5de7ec0b61b4be087c267f0176b4b3c0e5ce57bae0ad32a09ed834444c9c33cad372345

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
97c4c9a5449af23b28f190fb0978f180

SHA1
da119794dbbda97bc3199c0646981329f0cf9ca6

SHA256
9caa112b768e308d2e40267d392513b9d9b587ec4d14fcd16b11355a7a7c887b

SHA512
6986687a4d603f7c5b6a6cbf30bab6899f4b552ffa70734f812903e3dfa522de41d4dca20ac982518c0fa5828be1b3a632d80d9c963e8f156ae5de06fbb6ddbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d11b632ce36df40ea40e65919ebf2c89

SHA1
e792171ee6535d1ee5b3885eb0e97a8eac9e699e

SHA256
611b5437b0e6a3dd28ca602edf0da3b21620415fc50a9f1b92c66c33385678b3

SHA512
653d0591f4b7c7edfaaa073a9f583a49300af021c6997068bf00ec74f2a5772179e8a2544081892554e84bf98cf753491bf0f605caed3a61bd19f5b8b1fe1489

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6fc74bd8d1373f58899a47e11051d59f

SHA1
5f70a2c5c30eb790a16eede19f4a47598655ba1c

SHA256
87a0f3a31739a13a5d696a42a99d7ae27571b3840dd325010ac9e9ebe0b342a5

SHA512
6b663bdbd65ce549b3923726c07dca7dc503d29d40f7703d4807b951ab93168883c9b6ae50c86e7f9b1cd214737715f28965495c044ffc4727bbffef0a7a0ec5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
84847eb2099a3c777bece49f2c5ae3cc

SHA1
a2f24113e061766dec1b220bd3458c71ef5689b4

SHA256
a70494550cc6b4e98be372ef0ddd1b4777bb8ca0238769242bd812777ece0851

SHA512
315f2ee6bc9f9317f688d0c305f89861130b77aaca375f8d11414899674f7dcb2e12011f53f12281d1f71ed58b973fa0573664c9903d7b7f66bfc230db66ae1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b59c32f01dfdea8ef9d0f8a093dfaabe

SHA1
c0c694ccbbd1ae1e6273d0433a5041eebd9668fb

SHA256
39fe2d4c167622a41905560961165fa1b6a4dfe072bda7981e77ea897f424722

SHA512
0c38d46291785949278cd8bbcf9d3a11e8e5b7834c0bbdc19ad012e0cf634db7b16c55eaf771b31c088183410ca55f191ee5de9f56e199b702b125ff2719629f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ccefb8bf482f7255e519d2a5606f490d

SHA1
1bc30e81403af05a58da2dccd16d3396b4eb7b4c

SHA256
5ec01c12364ce0edb52afff4a1a396a90bbef5aa7cd8bdf61f5b1cd9ff522523

SHA512
4653778ea2bc21505a67ff0f4c72f403f664bd1b2d039dad655d97de8f2a246bd5ff70326b2db0a43ce9d34d535179c666b98109ffcef80b28340fddf33ca838

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
ee4d0c3384ca3ade78fa2f288aa02289

SHA1
c9877bc77e33ee83218cf0bf8cfbc5445816ad7d

SHA256
dcbbc3bcce02a332abd64a96524dbc38a4b966d796af120d34f9e35611d25586

SHA512
af52fdfaaa3d91d44032b6f01ec5234ea395eb78d1e1cb03a1b98fe4198f0d76cb81109ffbfb0063be45584f33bf7d103ff379c707bf638f58d06d3b3009fc6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF2F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarFBF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit