15f58300f17643f63e9ce3760bd6e24777c100b39d2576e1bbbb78930e1a940a

Analysis

max time kernel
118s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 08:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b2b1c43ff295d28ebd3060a728df9a4e_JaffaCakes118.html
Size

10KB
MD5

b2b1c43ff295d28ebd3060a728df9a4e
SHA1

378240a420790f2781cfc958edaa33592f55111e
SHA256

15f58300f17643f63e9ce3760bd6e24777c100b39d2576e1bbbb78930e1a940a
SHA512

4225505ab98f0a0bec0c49cf6ec341aec59b0d614bc287ff8a48b8a7e18c58ff463f45370824f8798f1f15fdab41352999aa9bf5fb889c0ecc536353c4231426
SSDEEP

192:r9rmu2XAbUKc7FgkuT2T7ZkL1lsLXE7ALvp6pzpgOp2SpNxpzp+apTpzpTprpjpT:IXKc7OkuTijd7gBxxpRhxphxR5xhR5hB

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430389263"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000fad71d0e8aaceeeef3e4b3a153825e988cafe05547a6da4d6b0ab21bdf8901fc000000000e80000000020000200000005dc514dae4cd0db1080eb560acc69ed84c394f5ef0802a5a5b5c2f3edec8f1c920000000eaf71763a55994440a916dac2420442d2c1112fb5539515af406fdd54c80361a400000004246c1202e2898e4d151d63d8ca4cf87f02a67451d0f936fde8bb6d67cfa183f696e3e16fec1b08a96b6feaa747258f2f0ae116f6e05a95f1e8ed9625d63db1f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0f1dca8a0f3da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D19496B1-5F93-11EF-BB9C-566676D6F1CF} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002aec918cb9fa9248b7812ac80df2e74c00000000020000000000106600000001000020000000b29d0776cf0e1baad824d70e56806952e8e06e73be65141b930db9ef491374e1000000000e8000000002000020000000eb14c9d1192a569075fe494dce1ef504c97e2bd4e74a2f848993be7f462b3aab90000000ed1b667f3bd867bae6ec369ad6dcb9cc179742f0a7d8b7978b6c40efe95f9dc460a1f15eff80c6587733abe998aef6a6d331b80591d492459e8e39072ac80726377d4fcb982cc35eba5acdb875e9fda9d2c74d8f2c6e6ccbafd152ca7f89e2d3e4b1677d99bcbd65374467e1b44b2709a5a622e0a840cf98030579d07aef3b6db0f1583bd40d3079bcbbe749ea723ecf40000000038024917637c09c199cd2f48b7d17791eb2c2b4925f42192d62a276eb6c327779589d2bb1049ca590986ad6f742a8bebd5768c6b57d7c12288668e3a39131b7	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2900	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2900	iexplore.exe
2900	iexplore.exe
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE
2404	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 2404	2900	iexplore.exe	30
PID 2900 wrote to memory of 2404	2900	iexplore.exe	30
PID 2900 wrote to memory of 2404	2900	iexplore.exe	30
PID 2900 wrote to memory of 2404	2900	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b2b1c43ff295d28ebd3060a728df9a4e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2900 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
3ad0b4debdbaa6162ae36f42481d241b

SHA1
b9443477cfd2e1157b0f17d090ddd1ceb1fdabc5

SHA256
6c11f7d4ee47a6403071a5a469b0431d7ca122aa5433e6ffcb5b81f7aa52eb85

SHA512
5736b6748f40c6ebf127bb3ac70c12fb3a4f95f704f3160c942ec6b3210e2c053f134033f66741d9918652f53b36e0424356c614d207d1ec3d1f79031d74c54c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
dd37491710d36d2832a8e94d42df1415

SHA1
176478476658fe7f3d6922488155722a79bc9876

SHA256
c33dc71257643e639e20f5bb0f7afc39e225b28a1e84d329ca55d8fa12adbc62

SHA512
fb6a38afa02e74161d5cabcfca6f8964dce4da2ad2ae23bb0f1e52e43d01e9e91bc90fa1ed0ab0d275843816b6290f8911c2b68093d4edc4fd406b470101c443

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
283782aae51b1cd9ada4f44f439acc64

SHA1
53d8d8ad627406d0a8d36025d9c98d2b3609af21

SHA256
bf9039b8360e89f32e3814aa333e078004c2c945062fe32abe451a43b5d2db25

SHA512
cf3f204ab95abd2694e01487c2c65c0eddca8b245507aec9663304482f6bf8b9aa9f5336fde00cbb7560e5cd50b61edcae265ac1c2b4107d16d8d9a23e4a2b74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a7c2c49293b4a4a6b5ced972da7cc552

SHA1
58edf5cd31c6b23ffa263c02a250a620e8ca78cc

SHA256
0141fca7194d76d11eec8513413a941ac5d56f91ba1d418c08928be7c5d18e7d

SHA512
18e1aaa1f0177f3f84068d32d71d677d46e8f1567963af06c26cf3fa64e24931c6ca1a0ffeed57f3310ac314e5d639051b6cb1a68b502c4798f9427e1324179f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e68aaaab5e230031875e613af2d65b54

SHA1
455d4220d58ccec44b1567173c7057798fe473d7

SHA256
e316fe16bed9e0fad86f6af83e4d65e01b397a68ee079d40ea93409c9d2eb2ea

SHA512
840d16dd895bd8eddbe9215bd4a86f52e9e2b8eaa36e035e88ba6f0bc14c0cadc4e9b5401a2aa3096f18602fa6bf006b9ae78e52eb0c6e9dc431b8bc610bc5c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e732e9e9d0063918ac1d0276e6d7f8f8

SHA1
d814ad91e81e832da8c8f46633dcc7b8c33ba585

SHA256
1380fbc54f795b575d4efa4a91e1d2865e08e6746727a5067a28523c31b8b69b

SHA512
41b9638c4694518c8f7f1d91ba0da81f88c79a7a26a1522a32ae98ce92260e80c658d431331abc63d6967febc908b0886ce66c5efbb00a5076e4db63abd9d6ee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
997bc234c144d000d47188779ffc1d76

SHA1
39cc3efdb0bcc93f7c56c0055b5b3fda6e74aa9e

SHA256
82fc18da44916fdeac1f8805cc2cb65092b9005c607e4a87b8d0d6dfe1779a7f

SHA512
fb15b0f53541fe93df6e63b2f99780d611309104c529bade6181781aef5eaf0d83465b4fea68c1af976fe0882cc691faf27d17a69d1481f87fdf3079f346ee53

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
f875558c6219dc3852d45b465ec33f8b

SHA1
543e02ff84b1c98345ab87bf50df1e763bfe689c

SHA256
ed70a3d02d2566fbc901809dd769041c0e6a86f8c82ca66e7beb09c64d11962f

SHA512
8b802a04c3f85b53dfad1182466b99ab523bd5a26d11d9b75c01c7435096a7b41f600ede2de3ea0e45a5e937e3336c4c34f8b4677b303b117c8cfc6ea6490d3b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a45b6fba3431f7e8b966be26f6ee822c

SHA1
94654a7572f82c83d0c778155c73b85406223bc8

SHA256
aad9b22fb892772b8765b8658dd485b8ac6f1a3bf23cb86de7ff4fb2e1e20c05

SHA512
bc3cb26e090b4f5ddb45a1088cad4295714441b53442080464b9a16955e2bd8bb322f167f1834f684b44ca368267f980c9f0566f9cd91ed7c0b0e5837b8cc408

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
94ed6be3e60b719a214e36e8b58856ae

SHA1
737fff2a47d4f4760be5203a442fbb00bb53700b

SHA256
f1f2468b89b7f0958a6986aaa485fe5ddd137838e61944d834b58c42915edf68

SHA512
78d628b21ef95fd98557746ae027c72830d951d5d6194c1b72c70e89dc1a88a0dfa8bd74e3d04cf85218386ed5d14d3b9e3ddafd69f7194eb6670a51c54c6e76

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
a34c4a1bd161ae5f12926d7ba2d5d5b8

SHA1
76d5abbac8c776edd5bda94205152e51d27a160b

SHA256
741bbaadf50b8fac0468c18f1ad000ec91defe709f2b2a03b177b59ec3cbe2b6

SHA512
e3aa2f21bff4c423c0832d1a130b2806170fb0e400232d9a1e0687323a79eca84ee6bf19e4cb9a89b51d5a6fa7f5939cf7cb8d0217d42a38d286b9ac141e19fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
e8f16d329b2170d33296268f2c17d169

SHA1
4b2e3d6a073ea165c10e749c67ba097ffb02aef8

SHA256
8636cba382d26c9a9ae25c9a5c2cecd4ba543d07e92e13c7be44a400aaac5254

SHA512
dcdc2fef4b8e55c759a1ef2714305d7bc8e4790cf27136158f91e04893818ae3b531b1986987b3542b5e558b5a4f8400f5a94790d2f26f15cec1b05c8276df5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
49771e1b24b622445338615849cf0e6a

SHA1
d2b4d223fa5030d83ef8b21b1b7044ad70dc33ab

SHA256
7c700e72c728ffdb93429fa7ec37e24398dcd0b4b6c7a8a3b79380414b0c6c93

SHA512
1c245ab14c90900948c6641e058a357e4215e7b63f99ecf7060e28ada097713c7e0de1815c759cebe5a141028fdec68e659cd40bf621707c2e80f734daea4c64

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
304B

MD5
064c91e9403376f64931c3be1e00036d

SHA1
710c0ee2d5e1d5c297b26c9b939c15635e15472b

SHA256
002369492112945d58ca6eca6e8ef712b42a32f8b20d390e4350e734a82aa2ac

SHA512
5c08fb25fd96e97c9e25dcaf19be8ec2b3bf772cb1ebb355ba584482b42af0f85f07d07de100fc65cebc7697444144bfda00720280fc17ef2f6c06dbc40f5ada

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD9CC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDABB.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit