61a0ce0ea64267cd20ae3716c427a38b91f44d795501c33f0d687883c6ed7b32

Analysis

max time kernel
138s
max time network
137s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 08:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b2c440db5558140eb8da763521618ed3_JaffaCakes118.html
Size

34KB
MD5

b2c440db5558140eb8da763521618ed3
SHA1

33d0203bf5fbbd721a671d63d2a3f4d701929c21
SHA256

61a0ce0ea64267cd20ae3716c427a38b91f44d795501c33f0d687883c6ed7b32
SHA512

3c8a82c6d2bb8aa904c50d12e60e4aa6f0ecc6f1f26b117dd59900f3565bfa441e690a3d1cb85329c5628e17520ea3f8259497248fc9c31e7484620df9cc3f86
SSDEEP

768:Muy79xwV/dH2hmVgIBSRSXI3rK8TEiHrT76hWr/r/BaMkvww26rhUg04/P3msU:k9xwV/dH2h2gIBSSXgK8TjDZaMkvww2t

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000006224aa6a90d371de3f448b9253e0b008f1d065bf4ee474d3c409a94160425c2d000000000e8000000002000020000000c2003b2f71a75d8cfb924a577cfbd34b35e42f1a6eb7783515f7971fa32a90ba900000008634cb00e04f21e823060429bfd0c2ce6e6ff87c67b5cb8a5f010aa6394777aa13145e35eb0857687e9b57956df4db19e14d9caea1e3132168dfba46ac975dea1ab45cd71b6eff155d3c78c18cbb1fd4054a4b0dea075dbc8bed82fef98eb855e5f0504d449aa7c6ac969849853eff089c933aff72ca67447b320a8c3bf3ab1c2555f2ed0da6fee8f3008932f9538c36400000001847831f2b8c920f28d04cfd0a815ad4fe2b8b1ce3341db1629f35e7dba5ba4c1fa3c5b0d0380c15e86878422afe7719bb3528c709b124bf71d9fc7244d428cd	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000001d9b67f25107da9e834bce802b4b7308d17c7efe00e869c9b53863958afaae87000000000e8000000002000020000000b88a239a2680a314e614844cab2be129978f84b0c2fa2358023639f1444f40e720000000391d2e34f6099bc2a5ab11250777255bf6c4b243926d5c0df554c3b50b3e0cf74000000030419b73c11b51faa5b86aaa3097351d174ea94f12b46629f2951ef19d1f6087130ae5a5661267577a760dfaffb0939d97c90ac7cdcea8b935cff6d64903b643	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0ba5641a4f3da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430390810"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{69D81521-5F97-11EF-B29C-DA2B18D38280} = "0"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2348	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2348	iexplore.exe
2348	iexplore.exe
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2472	2348	iexplore.exe	29
PID 2348 wrote to memory of 2472	2348	iexplore.exe	29
PID 2348 wrote to memory of 2472	2348	iexplore.exe	29
PID 2348 wrote to memory of 2472	2348	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b2c440db5558140eb8da763521618ed3_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2348 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
331d5d366525bb0cddc764d360efbd42

SHA1
35e3346ddcd7d560558b786df97b0d3995bb0fdd

SHA256
b6f922494d725fad1aba82e28d1f235c97d7e2e9785898a320c36e2f83f6ee76

SHA512
b1e56b396fcca1b69bf32a69bd11c219de8279afeb6713c7c71670bd84c5635f40267aae661b97dbedabaee6b78fe69930f88e000a7c6f1423c91840dd32cf73

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8df941a9949686eafa3f64436d3c226a

SHA1
c556bc84215a62c895c98caa78a79f6cd2c0fbc1

SHA256
9e089557ecea61d8af50856459f8e8fb8962cd35f01571ce53f52219ee7fd318

SHA512
fb2cdb72a42122cea25215d0145ae80a952c30d13b4f9d64b74bb27a996e2dafbcda95702d28f0939b53a29c989fcce3bca5dcd509d0df2aad1f9f4dfa72c32e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fb559d30860157bd25d0dc06b300a24a

SHA1
c38c59d544995f26ead1fa0a39c6eb37e9de46d7

SHA256
18d12864260dc92d66eb392fdb8a6f7b5660b4b891d299c5436e3f255f3d1e7a

SHA512
41bb74a361728ffeb206f655885998c3d9a27c3d51207ced89eab92a703259ebb5f2e1cafffc703130c08ac2579ff9f05ab0afa20ec6d340d0194c930d74f861

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
73fd0bab9e218ea254bbc8d043b223bb

SHA1
bd64ceb67360c81b97c6bdc95c5ef46db6a34ea6

SHA256
5764d0e4d03e6a40017b4c820816ef23ca5e2e7f928501298af081077007261d

SHA512
52504edaa875071dd35290e1077433cde5c103c3c66f87fb50d2694a2caa40b1820f13845721196fb258986e182b2f69fb5439eaa8f131491f81774b2f125f7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
61a054d9c5a85bb694eccb69d44332f4

SHA1
91b6c9b4e285cd23e3674e7ac2680220d15aaa71

SHA256
372ed2222422437524e12543424e0e6e53b4caaacae871d6131c55514abf06be

SHA512
9cd42a5a160628023214e2eafa7571041bb244dba5d33fe7ddf245e7c03d74862be89b1d43266d8ee269f8163154b8997935be837df5003e3eb71bba4229d2bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0c221c202fe79b7582f3ad5a095a6434

SHA1
e0a9cb17a4e7c1ab7986107423e41bdc3ad7afd8

SHA256
7b46d0bcbee78151c5cec37ed932d55cdf05a7f04a004c8a245e1e3641c2ce93

SHA512
804d7e70d83c9f2a11b1009f00be4b405ea0431cfdc95d35d8cc773c709b5f98484ba69b7b92bf3c4358e862c813bd7266c99380bc5ba6b3883a144ab60fb257

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0609a427f3124d45e59dfb054f7f2944

SHA1
0b9b99c8f4b5ab6efdbd0ac247f9ec1b40b386ad

SHA256
06457c7a9af36200e42de43a6b492f49cf40e0e9123951ba1a20f82f4b596cdf

SHA512
aa821fee73f7f1e8fc211c42d0e34e2207dc071593ea336bb60c8b0245141afa91c6e7ef4d93d5c20ad01dc3cc9d68adebd2b9f4d195ee9c5cbd0d7533c52f16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5ee3b4ec1b1db1d8858ed6d077785e6d

SHA1
31d77b70d0a4c5322a0883641189fadeb93fba7e

SHA256
f1037414fd6fa26cb170cb34d21705e9059a45da2bd980f275dbf6a31f41fbcc

SHA512
f4412c8501614d51456fc8d4d50fd4a907695c629535dc6147c1903d042ea5ca606c6ce7650a2e812efc11e801190dbacc9e04508ea705e27ebaae6cd170ddb2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eff544a92de0aa326479b4dfabd8ae89

SHA1
cf76b2202332f579ce7f09ed05cdf89b62926346

SHA256
98420bb814f878382030c7f661e3dc7082ba3e1fda8aa8c146302a974193832e

SHA512
0cbcb9638add88d8a288d72cb584c787a358bc3d3acf5eeb531cabdce2c6a09d018e5784454fdbb07887032a5983444997aa0a3ae9a37b461b18780465d77d90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
04d608943ba001acd949e9886d107f9b

SHA1
335eab7cf1200bd106687bed3380ecb238240eb3

SHA256
a167563a6f1f2d79e5c4e60420e8c4424d7ded527923de2540e105f67f53deb9

SHA512
c390559ae0521603b97b3d0ca9907b646663871b2e44cfdb0f4210c689e842c367cc9b797b3c9066d085f36be494c843ae394ae6dc0f22d53ae52b8202e3bd8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
722b816fdcf265dcf069ba5d395ce89b

SHA1
7f0b3e8557333308d7f74638a2a5a4dc30947761

SHA256
df076cb260cff4fad45e2c1fc2c9d14a187dc6438d69b13c1ee42435897fa3bc

SHA512
01347f69ac400be6f6ba4f069b17ee520b2238a1a2ec8ce47334dc8fc0a202e77609889e6b2542cbd797ae3e8c1df9a202f0c16f58d39955208972498ff37a0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
78b34a9c18a73a0ca072badf0da78aa4

SHA1
6e7a910e827102f04d74252c52ae1a94ea0f8907

SHA256
1c3cefadad1fa3c323c1355ca7e36b2c79fd7e287b0a732cdef48fee4253f6e6

SHA512
0d5a6ababbb958065b0ebea8da7413597d413912666a728c422494a4fc0800fdc5773b1daa75765f78b5d7b37498dd69191b2c9bbee409191a98925baa901690

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
db6b9f89939fecc2cf0a1c53e0cb3ff7

SHA1
5d6d9ed3f19e1dcfb888028a90b860ae51e9a501

SHA256
9976776573d1a516b0c27669acaf34b2749efc7d63da5520988e2cc909355f85

SHA512
868be0c5f0b00b8059a9eb65ed108e007887c4ba3b967d0e01ecb4e6746ac36a221cc8c1d3bfadb36b7d8ecbe730953633065ea00ac83b7e2ec574b37479b9e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
68ff05208e5004a3651d8cb546504f0b

SHA1
2b61f0fd8e302e3ff00bb7368b1be4ef8aa7b5dd

SHA256
09416dccc0179d8d3d2b5428457c807a33d9f303d2e296b5e4c2259521314db3

SHA512
36a31348cc5e4c93e152f5a3b20527ef5b4318b9d0b95359f7e19858a056377caabd05634b0c4122eb3123e6fe7185feecceedb88d189790b32b9bab364fc9a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab64FB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6675.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit