8a6f41ea4530979533426ed2fcf1d9f9c714e932549bce0f8f58f597ac9d6709

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 08:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b2c37aa558c66e5712752756f3308e64_JaffaCakes118.html
Size

39KB
MD5

b2c37aa558c66e5712752756f3308e64
SHA1

9092920a2d1cc96d8fed890fb908fb266088d194
SHA256

8a6f41ea4530979533426ed2fcf1d9f9c714e932549bce0f8f58f597ac9d6709
SHA512

c5e93931ffe2026ad178c4b644c753eb0acf795c125cc425dbe8485be29642c4ccda2b1e9c64fa0401aff26aedde4d3c2ffd4746e99d45966b3dbbc513ac65d5
SSDEEP

768:bE4lbKV2pQqYeEiG7XSMgKqvEDLZgI7goX3uL:bEiKV2pQqYeEiG7XSMgKqviZgI7xuL

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 408ccd0aa4f3da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430390719"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{34D22B41-5F97-11EF-B6DB-72E825B5BD5B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000498f67d1f7e1c43242d01a5fe42aa477188859566102430f311021a3bded5812000000000e800000000200002000000049842a1737252e9798dbbeb1980029d0fbdbf8b97b2fd62617b733b4e3f6382220000000e4a82bf13b6237eb3f70ef02281bd98a5ffd432421e830e64a1db81e4a064817400000002e212221787ed02288abaa49ed82c792c6b349882c88f89548890431eede192b80e0b03da0f36d979a6efd236d0503cc3616c5ab8781f3aad82b0b4858d2c99a	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000046a47c42a3d047cfd6acde9332508f2099b98e854102305e2e09fc91c76cea9000000000e8000000002000020000000121b14d5d31cda3872c8bed556f3c1a72458f2ef1baf4adb8a8ee4ce1dfa378290000000de3982644f534b7e1fd932bac2a04479ff4ba7dfeae075a4ed716979dbca2289b61ffd2bb2ad3d60975eae29a26d399ab1bd195da11ec2beeb56f3f0e7b25dcb93d396cf853f0327abe8fcf51e6843ec4b508a9031edc10d859f16badbff822ee045049035da0691e91c7a711a68cad5aaf63bbf9420040558852187decdd245c96b3f92b9fdffd782a4b3c1318762a64000000089b5b35b38e9d6f78e0d2b093ec09528f0c2acdd54830147b5aea8535b102e4f63e02f7d28e5014bf2cf4e79ea5f1f2c876796d4c06f400fc09a3e6cb273f2c8	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1676	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1676	iexplore.exe
1676	iexplore.exe
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 2140	1676	iexplore.exe	28
PID 1676 wrote to memory of 2140	1676	iexplore.exe	28
PID 1676 wrote to memory of 2140	1676	iexplore.exe	28
PID 1676 wrote to memory of 2140	1676	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b2c37aa558c66e5712752756f3308e64_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1676 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
449058dc5d564928231fe48842b23c69

SHA1
429fdd3afd05429e12bb65ac0b43aba5e05757a2

SHA256
88d3e898d3c481653284b11dd565ceb9a7cbb1077416c00cab398a561fbcb39b

SHA512
f0ea3b9f294a48d5633c1849c5a280b899b831975420c07225db29de435cdf4cd83289d3765b6162d19423159a9898d504968bd9b015c53218c33bc3ed9e24d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6cbb42d7279141d05709f7e2f0018099

SHA1
a216670099335c2b10f3eb6c16b6147bb54d4d8f

SHA256
a74d5c078fa42d42d651898cf28be1078f4b83bbb7ee4d11ca16f284e58eafb4

SHA512
1f054895b78f037591b1b61d7e46777122c8b592fdbfb14950b61101148891f8c3c07fda4eb6cfb0a6a4fdfca301a159afed33d43c7cf8847f0aba82153a7abe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
effdb5ff0e13f5b0dcfa9f87c098b4e1

SHA1
3e2e5e82cd58499cbd08883c0460d6d7fe557717

SHA256
b336905ac52027e3bcddff189ec0c3afa078af5261f145ea2d1bc7ee4fa8718d

SHA512
ec79115d9a13bd1a601288618af556b78b32172e67bc0a4d59dcb9b2d86e2896bf863f3f0ff030d7157279ae47519aa9e6c426a56ded0b491a28ebf0872cb611

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f34119b0981bda877eeeeff6b74dd638

SHA1
688b721633102fa0a318d1a63b57ec77ae4471d9

SHA256
d72fa53a9f74be65eee01b9d447971cba54c8816ce32fa792c30dcd4341769a3

SHA512
4584f0b5f10946b006e9cae29f626f06c4a5979e4b36bd13708e3049ecd7da082943dbe9efe01939accbe80595498c7696ec00abe81985575a08734b7101477f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
53681d55d3cb77bdf68b17a768f9a857

SHA1
bfdb0af3be65e7370a83e5cd3e8e3e5c86722eef

SHA256
aa5955751d2f5212962b739e1fd32c14f13038fe64cc0b961eb87848116b3d13

SHA512
dfb2e36d88991dbfc0a0d45b901fd6a26351215a10c25a9a0df12009b29c5b7eae902a46e9d00825017ecef8af5f38209f02b23c00e7a78e33f61c83ceb3353b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a365014ac333a843be883cdf89884a8

SHA1
7d7330f786b409cbc2f518b6e42977ec5f4f023f

SHA256
375af86eca376dc98ee6a9576885fb61c0e2ebc8d58d934ed01341ffd8050869

SHA512
0eb644d79df8e98e64b4862df0674ce66bf819f0bc1a06d82b7de31b026c7b6e9f3c81ce2b59ee47328d046d4acb4588ef7c97841bbb31ba868655a6d17c3f05

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
34ff956465092bc9eceadeeea2fda5f2

SHA1
4a77fa01b79a218509c781be5b361f41a3a0a1d3

SHA256
9b906bdd1bc7bb2d33ffd5f3485fd92c53f6357b92b744ebc2c80b756187344c

SHA512
7483bb372e2abb1d23a084ea73b0b2494e853f1d06f895cb20f58ab1216f9fbde8edb5702fa0e749251fa0289b5f261a7a9f161c6d8faae2b1ed581ff1571e41

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e1005b261aa547dc6a3d432b610c4bde

SHA1
3a638efe46fc7c8cbb2b6c915c569a15e8bf5c2e

SHA256
1612d7cb1cd73bd16d0d25a83ebf313db35577d6e6bff64fc40dd3fa39c4c7c2

SHA512
dab602fca6bda8312e0fa0552835f7556864186e04c971f2501bee75b113ef870fd7baa219a22a53ef2c1465265489f6faa23907531c954d8572b02dc04dd0da

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
64241e95b4588a6ca3c555ca8938b178

SHA1
3f1830cab36ec4a39e4b8b5a17bb796a44a698e9

SHA256
7fc5206c64bff0af439c83026876d7f7de37d9adffe14755d6a489eb862122ac

SHA512
0613493c92737cf237d7f606e3f0a6a468aac0c87aa5a9b12dc1c500dc22b993392a46ab2c9dc93641d73893fb41a801bfc9d12815d480fdd397e05ab615701d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dcde1ff69b901f7539ed77f24acac33c

SHA1
9f2cbf391c9110a331007b43f36a0ce9f20d6307

SHA256
669209d3c52cff34c3fb3005858196f76811e1890623481f7cf140ed70fb01ff

SHA512
2617dd882ee3317ddeafc0d3077b53630f569665d1c40c9cf85aa4c39a7f61e1865ba54b415f6d5f1be87e5e4ea36f849e89a911a9099161cbbd92ba8a286eb0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37bd6d1651ace6558dec7444d99e05ea

SHA1
f63de786daedbdcbb178656f2c6ffa02abec07e9

SHA256
6720b814193bab6b542947cb1be4dec32dee882f929c76867a875222077c9db1

SHA512
d7d9013f901383cfd0b431daae6cfdd8f8291b1cc1aa2042106cde7ae586089ec48f87f9bc568dcca96c91b784af12187623eed94a6265ecb62354257da0978a

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB404.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB5AF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit