2d11fc336056d3dbb842850354399efdd426ae808e815887c3ad98103dcde2b0

Analysis

max time kernel
142s
max time network
144s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 23:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b573a0caa930d994ac00190b097c0288_JaffaCakes118.html
Size

96KB
MD5

b573a0caa930d994ac00190b097c0288
SHA1

0b85a7dbae3d1bb9a2ce3666be2bbd98d7db9d87
SHA256

2d11fc336056d3dbb842850354399efdd426ae808e815887c3ad98103dcde2b0
SHA512

38e598bb5a66bfe72750eb8075e06bee4f6a8510be5d38aca1e4b53d0c1ac30f2dc4867688ddc105e35c370331fe14e84eb19881faccae411743258474f12afc
SSDEEP

1536:S6S0GzbmEmtPmXC4zZ2wQzRekFZWJRigGEFhH2csw:S6S++XCTTzRBIigGQH2cF

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb470000000002000000000010660000000100002000000073cbc06e3bdc5ad2affbd2545da56391c3d50ffcbd8dec6f311a7682d4673f69000000000e800000000200002000000012dc24e7fe4f79ff8f15136b324cf45e7872daacc01ed8ee3ce00f24ddcc84b7900000003e65631e0293f3ee33040941e545c63d94956cc5f55081e06d0f7b5bae1668a5bec7183ef5b46fda6e413c9d2d483fd8eed19387bfa883fc73bdcb547a309b9bcc419112a8b0c501495ad22cc188169692fe385dd313de19dd9b9c380acf6ca5e0a8453d7825365991ff57a6b23af40da871701aeff0fa4e0120fa7a569a064524ad723fb37a74e7bf28da0dd371ec824000000053ee81d4c5b1bb6bb1b1df1bf39e5edf5e9258a48775c9a4b449ebfb82a8b3203bf4da53468d18e4352fef982f2cde83e7b0821cf36847f96afc59c603705527	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1497AE41-6014-11EF-9D33-D6FE44FD4752} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d00a81e920f4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430444352"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb4700000000020000000000106600000001000020000000cd789ae977bbf996b2d28575b034f1f2163d62c905ab19f2f6a167bdb025519e000000000e80000000020000200000001978bced6a9238f54c05e887494395c3bb5fb4e51496b5e84bcc591ebeaea22520000000423d07f158f1629b3c1cd663fe4cc736a3852b604785eee6ca1ff7fb067766e540000000f2b3c03812542a70160a9bd594c3f1b6779f42c4e4d2c85d4e67b11d68bb9e07bdbab43c4f36cfe2c891f13a12623aee01d4f20f75deea6051c2dcaa9ca2e8ae	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2364	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2364	iexplore.exe
2364	iexplore.exe
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE
2760	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 2760	2364	iexplore.exe	30
PID 2364 wrote to memory of 2760	2364	iexplore.exe	30
PID 2364 wrote to memory of 2760	2364	iexplore.exe	30
PID 2364 wrote to memory of 2760	2364	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b573a0caa930d994ac00190b097c0288_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2364 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
b30b6cfc2bf6a86b385b6840d0791dac

SHA1
213e891a85a51d6006f799a868c14e7dc37ac63d

SHA256
f0607b89f9376434974b17306f38f98282f3bed576f075ccd08474fc856bff1a

SHA512
d77a5b161334596712b1883e559f2f791652a81f6661e56a2976ce202e32c9b2ee9861e2cdd42e20988dfb24dfaeca1f7d2407d0d84ba948aee748c578c41329

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20b4a939ba7e6a8b6072550771b38bac

SHA1
845e627213ed127f640d68ea8eaba4c7776c245e

SHA256
5e28565f52948c7044052ed14085f3848fa950ca988fee239f8ad2a7f2b8c07d

SHA512
de0d388c56865746705f46d3f1f110f236e45154780e577c186b9077a24ca905cd9de66c0e25ab37fb45c6dbaa8d7686e0b458066a1d131da21cffd285060589

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4784cae90c46f84a8feb021844f497fb

SHA1
4650f344af35ed0a6340a7a5466fae191c4bb619

SHA256
dc76e68a1899c5d1544a017bb3d443968c455cde1128bcc87624f5affe4c0c66

SHA512
ca63fb6c8cca32fe7f72be0ad9bc904f17974e227fc407fbf596837fefb4f45649956ce04bc208599d8e8fea485bd4f2c58d39fc089a6516249b633ff6d8eacc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0b89ac0d5e84f4dde9ccaaebf099969

SHA1
1f257b867b74c4cefe409d63240de1bdaefd1051

SHA256
2c9d1d1f6508f5f194984ad5414febe8608f9c01aa21067efd7e3d8a1a722b53

SHA512
c5a55aeab49a3e9acf145c8ad07591228b90d41fa6e3b301b68966e95a1b06163bfa997276a174ce048fc55922837f8a086e63d69358c040b0747567a8c849a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f9ac091b1fca81c6fb0ea3cb16a2e9d

SHA1
62fb66dc75713812fa883afaedd8e68a12110703

SHA256
df682639d64b245006eb443dff6e0f340176c74c4e0434e9a0474d0f53c47f4d

SHA512
184881606f27007084f2c7c9ef49c4c88e7ade9d2a59d907bb0c7bdcd0cb4710d36f66975e76c02f876d3e76144d55888432a63ae2114aac71795ce94a70e2e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61c7d922a7e4eb51089e685eb2c49b85

SHA1
3bd69defc65a52e50d8f7837864e0e4585cbf2fd

SHA256
0b4d2d88ea36ad302cdc187f14ef9a199b8e142cfee88e666171d9a337aee3e2

SHA512
b3344d09a9c4ed9b2b2fc71928bed89dd80989f93a1b3694007c62f7ee81e38b0034022d31a761caf5c25e92c19c03105fe780dc8a15dfce8cac2c869281b4e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1e0b2e36eeff69a256293474524ccd70

SHA1
cc308786e046afc7e8dd59df77498422c6f1b1db

SHA256
4e436a11257f3361ad3f5091a1ccff11efb0ddd7a0df2d891aa02d0b92fa3b07

SHA512
5a5304c098811c9fa878bc974b2c38885d700d0afaa922b87882a32dffd4b947a3be79988ee0e97c3d2c83dcb6ff5510a3541754a53ff289dbf41863a0e45b18

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22399ee1695754b4b5c5a8a5b5e97e0e

SHA1
ffca15ae3a3a2b61127641465182be598a2f0a5a

SHA256
d33b0647df6f854337bcfb19e6ef5585ffbef4987cc9c437db68bbe8cb1bfddb

SHA512
197005fa98ba49cc2c41c8d0db389e52f725c6b199c998e5ca73b0af2a6389514fd28c6a33874d356840b552c68e1ed512f04cb08d3eef7f03afae93b2ef49b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b458193640b221c29cec467cb78ee66b

SHA1
dee81ec197b086482c3858f4950456740730d386

SHA256
f8dd3f74996feaa96133ae64aeeb3f757c76b8f0aac2cd7c703e1c6620e98545

SHA512
e646851f5843e8d62a7f5cfda85f9b4174b9b951135675c043e18f17fe4ced2aaeab28b8bce5003dc0e080c5165e8f695cc269fc5ee9b81747a67b91db03455d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52c01c9c9155390946594b1050d6e3a3

SHA1
b365cca694c004375408705e1ef4b6d12cc5f78f

SHA256
fb5d12a2f330b425e575d55d0645d7c06dded4b1c8f3a57af200e55f8d9dfc13

SHA512
2117c4cf5ff5320bfaa3a5b403d74c27718e2397958fcad9077c502e2454e504d97041568dd02e0e5248bc254e3b2a4edc764165fc2a777552c779fc507e9be7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba0cc8e011dd525f6df8f92fb31eb6a4

SHA1
0228f9d3a0587175843e63d97f355c1733a09f62

SHA256
0a3f798d5b66332994b884cb6d2a279dcafc1b7b783f03ecaf4d6f2ab79ed1c2

SHA512
67dc21a753142f71934004f5363ec602771458c01df5d58d91dd645cff250852ff31565c3d659ee01c7c8cc9413a7af6aebb6dfe5c1c4ad7fd79699db370ca80

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
a2f8e070a96e838fa674788dc6d90716

SHA1
b94c48099e159e723b0431c6a8549af3e69defdd

SHA256
0b0e5d9434e5c745ebd72f0ae18c5fe6cb440473aaec2c6129ffdb2c71dafbe4

SHA512
fc99800aa7c45da6911427daf509a6c97d50bb1272ec160192231da574e1880d1d1335e266c08bc3f33d59f62953057fd511604f2386c7cde5d72d44cfa78594

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab70BE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar70D1.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit