43bd17a50a25c4f2481b8b53cc4209104c66d2a88a20c055c397dd220fdcebb0

Analysis

max time kernel
145s
max time network
154s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 01:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b1b4495616cfed3f619f5737346bcbb1_JaffaCakes118.html
Size

159KB
MD5

b1b4495616cfed3f619f5737346bcbb1
SHA1

c08c8c9c28c4e7035e0de5952c0e12ca8b8f96d1
SHA256

43bd17a50a25c4f2481b8b53cc4209104c66d2a88a20c055c397dd220fdcebb0
SHA512

1fa30e33024f81bb1f1a82e8b50e3e8f19afeab017aaab2393fddb3426596f7fefd5c9d4675a96a2fa5d0c8d2fa628ded54631c1f40825f4b1973a9d19bd0fc2
SSDEEP

1536:pbMjw2fMk1D3O9Pj2fcouDFHA2oGLbRZ5hcZYD7jNp:sq/nLphx

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000689a9914b585b6299a5f97fe1f3f8edc5278e89a226144ff73184d88913c2b23000000000e800000000200002000000032a5a27a4448be2945993e19751d7f88dbd2b9ef0817cf9933d42b501ab82ef4200000003c5216e2533151c66ac743003a1e834a19998c2946c7f5da9179fff4d3d8a32c40000000e87e7103b4eef840466b9d3bcff16806663eaf69f3f04e4da77ecf8218e8ef3ffabac3e694d6e618df748bc0a483868fab386d9d942d8821888dcbde757bc185	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000002ec57f69128c72072be87413ab30e00c8850324e83573b29497649942e74f041000000000e8000000002000020000000f3fb29ac5ec10279b5f320c38da2adf22f2639220d81d00d363e0ea875e15b4b90000000d83d9a5a64ee189a932a8f4cf890bffbaaaa6e2a70af2e0e61e0d411f735f549361c0301d0930f016734440ac796b0152f67020852d4fefa77684fbe0529f950627c0776d523dc72e6a85e906db1670938034b733b98db703e25bd316afab83849818f0be8850d365e8bb56b6eb8dcd045d275f11dcceef14cc668960ed30a549dba23d40847bfa1c3049c485df19d31400000004c009ed446204688daa3985c6fbe27c74893bc199401db43ceb91abac4a03b353593b3118a36368e1c24753b9935c69c6e9d400b2a642479b4218522beeebd17	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{891C40A1-5F60-11EF-BCF9-7EBFE1D0DDB4} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430367237"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3004c7766df3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2632	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2632	iexplore.exe
2632	iexplore.exe
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE
2652	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 2652	2632	iexplore.exe	31
PID 2632 wrote to memory of 2652	2632	iexplore.exe	31
PID 2632 wrote to memory of 2652	2632	iexplore.exe	31
PID 2632 wrote to memory of 2652	2632	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b1b4495616cfed3f619f5737346bcbb1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2632 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
acc2d16200e191df601f72a491e28559

SHA1
63fb510122bc1a14b1edb3f7ecd2927e612429a2

SHA256
13cdb814c5abaf32fd19a6b4b022b8d9299d0df55ba0f680310f05197657b1d4

SHA512
4f237ee44b23752cad8d2635ec3d4264adb1b12cac88a15f6401e1fcc3504037e9c51d6c4d90c58283183b3f11437f76405b2ed76fb6bc6d90a4e569e5724ebc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
32d5fe10bbd085abcea0acb0aa061349

SHA1
842238bf48306fb15ce915a970982798f02e49c6

SHA256
4ac44e12c997831aafe8aa88dedfb54fa177662f13172f6d30c5a79c8ff4873c

SHA512
923e0322057ba7ac06c6f3f4d48274b78ed22bba7fbc12a1de3c39d61e41042ae0499916f246bf86a4590ab6077a1e9c93ec3eb260dc54a10fa0dc9dd24c2fea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a28b8ec1832102c074bf85215ea3ea84

SHA1
e6b927ff7ec4b00766ed818a3697e2c9206d0519

SHA256
226581eb92956d967813aee4ef7d2d0c18842b482d337cce54f8a7447a191bb5

SHA512
41cb0bdfd9f657f27febf28d389c8fe71c23f304ec23075ee807795cc481c3e48e42bab279317570d6199f0d9605723b3185d09f8cd49e31863a2f6b10a120ae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
636e573bf2cf926b1a3d5895925c74ef

SHA1
26e2d351244537ea16187ade25b57c6ba1e35857

SHA256
0b9dd0ecbb46e9c80f65890e428829ad6c689c8f308426e4431bbc8f3e9d77c4

SHA512
c601480665385b859259a35726175ee92ce8c045f636d768b154f45f6a1ef725100a35988a0b1b7d4f1ad47096732fb6ac150f055593236c4bb542dbad47ac20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0819b324e3574ff6f042b8d21d5f5baf

SHA1
f28e901554663c32550c0c0d8ee7ddc50c34c8f6

SHA256
be40bba99ccb79e5b25936534ecc32c6563bb5864ceed74022bbfea11a48c446

SHA512
24157de56cd467119e9eb57fd18d38d130207b63d7f4645d3c2cc99b22b5e583ffd4ae115caab51c7bd0ef98b25872bbdaddb7b7789eb17a1245a0c98c529972

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6db8feb4eaebaeaa5044e2bcc842cad

SHA1
5e4f4c82236c4afcb44e190fcf1bf85297cd794e

SHA256
2c5de7aa3532e89f65b9c6cfaa326833afe6bd21e330b7f841c6168c6fe1a472

SHA512
ad77813cdd0a84ac4ae25f3fd852c2adad78aceb2e2daf385b3ce7ab0cbda1e3d43aaa75d78d3735b7933d8904a6e9c6c6a34785c72ea0501f71f7159d126c2a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9fb0786e22bee5e668f9bc669565b83

SHA1
f1a2edf11a4836aaecaf0ed295caf2842b233c49

SHA256
e69aa48562ceca0ea235d9cff25790fefd46f9fd1c169663ae2b9be5bab9f4aa

SHA512
1f2958e28ddea867a9a2ca992678e8eede4b27ae021224f03f8fedc5fb89be1dcc935788e9eeca6c4c769eaecc46698bdff2d6a43a868160991205a7fda3b1e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ac675c39286c10f7fa8aeecd2fb0b27

SHA1
e4979f7204d499edf88ac4568bb6cb3ed9a28f47

SHA256
4ab68d7ab69277af795d390fb1bc5d2e55340243cbd14e36038579856c073661

SHA512
90681410ebd2a543cac68b5f78d31ce8e1a04401ad48a3683b4fae70b24a789d815ab2c868671762ddac1ebd965686110947cb9d6143ac684e04c79795c07fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
edc8bc92cb55c30117cf3005f7bb84e3

SHA1
133228db1b06fbb91eed4e920b593169f3b10d52

SHA256
3376e3969f6f3f7dc752c760668c5c047b27c9087cd8b522d6a0ce0b963644f7

SHA512
85574035551bd11606a4d5e1a8a58b552ca85af243b4aacdbd6a055267426f9caeaf28f09e5af0bffe5200a4b053d53e326b995752b87cb7fb3d9c993c4a676d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e65fbc060e4ad84d9f469e7d536e03c8

SHA1
55408933b1871f19113524f5e29d544252d4c568

SHA256
cdf4dda320dcc03b65d02e54aac5f12384545b7d2b591569440eaa5a6737eaf6

SHA512
5c736a1641eabc27346265c8470e39055a124379a3029705f1c3811eb07629cf6d514f57e907693eb309a8f0e462942e0bffdd0292ec0c0df93da38595dea80f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f354e1b9572600d74833423b8e8d700b

SHA1
0f3b5d9e745f3c177d52c82f586bcbbde56cf54a

SHA256
750928dd8a18ebfb583dec2831da6bb32712a69f385074938da158f2899111b2

SHA512
88477953d3219089a899b8c2614885f7ee86df1c3777badcec1a668bcea15bd901b6d517d05935fe8d3ce88ec36035087704a43f5c6e9eafd0e45465d001f06a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e88a1200ecb1ca5f39ffd20613535233

SHA1
da448e4d97ad9c52e372add4c06aa4a3a09d43c1

SHA256
850f14067c711c2d9223fadc5611d51a070869f716132ca463b97d21f11b8d97

SHA512
9348486a20987937a1eed2a6488a107a3db912c5a10ed48299e560ad294a5531ba71e6a7e37eaae0aa1aa894eb635eb5469c50d8b786dc724af8069884e07eb4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
318065e1e4b7bbe05510c2f1f5fafa95

SHA1
d6ab3990d122a420cf816d223246e81f21d3c99d

SHA256
61f247672ae16b4fe4a0dc023df2d2203b980e2d7ce067b16c5004a46141e7c9

SHA512
551c7034448b8cf6c8ce7ccf9f79824e1adbb9e3cda058d53532979ee7975d233e2b33c29ae05a3a0048652428f06603e8624b27fef76bf2c6fe751e16cb567a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
2d2f75fbda941c1d7352b5a33bac4976

SHA1
70ef0c5e59d77fe01700451e67facf2b61e46959

SHA256
6bce2a2a6eb02a58675a81e99d08ada7b44136a7f2ab58fa604737e81e1f192c

SHA512
9059c42f3638db68b4d813fab17c041b912474fd5018abbbfefa272668fca105a8feb9eca9d03daf4aec3f344caa47eaefc75bef50811493b5e4101258173cca

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF6FE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF7CC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit