49d51e58580feb68b0b7a6c8c33a3183f33f642e80f846127b7d6203bf6a63c2

Analysis

max time kernel
118s
max time network
129s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 20:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4e51b2c8b6afbc7fc5db533562d62df_JaffaCakes118.html
Size

10KB
MD5

b4e51b2c8b6afbc7fc5db533562d62df
SHA1

7c1e86f997c21d51f976cb101464e9c0e4098af6
SHA256

49d51e58580feb68b0b7a6c8c33a3183f33f642e80f846127b7d6203bf6a63c2
SHA512

ed6f6abb8f5ca85e147c7f258a3708f8102fcaae9fd247ff184d98a7819f6e455bb85bb0be1dd419b9ae3ec35775c7545d8d739ef758e516bd90115bb6dea4ee
SSDEEP

96:uzVs+ux7zLLLY1k9o84d12ef7CSTUOGT/kP+pSps31DvMdlwe60UYRDvMdldlVHS:csz7zLAYS/n8SgaNUYRravPHb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000d91780fbebc11f4c87cf75d5d9ba26e63493841bd21f483e96ca7f630a5f014c000000000e8000000002000020000000230a1d4781bc8c5b2c95d1399235000f188f1d7aa8380ae836f8c7ee71dbe8f320000000dd728fb660d4ca17c732191e4f86869d4042827ff577196084e6979e138f4a5d40000000dcd6c130118bed3dc803f84eae07ef2dadfdbf14ac34e57382e330cd3455178f9bd88ae2832ad395f1640a160302801307f83391b5268ba3aa6c381391f49be3	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000000eb85910ddfb70b59080c7f2dd919f87fd12699e920aaeaabf6e7cd6f484c837000000000e8000000002000020000000f2e44205bf763644280e6ff142680683f004cf20c0b3d1ffe9fcf7e323632325900000007bfb1a4b5cf9e90e42dc9808445e6048bb2e6807de97a3ac4a24254bf460c9d2ac52da66d793bdd2dce8c106891fd163d3118464d91263233fee1ac710d9468176a3a95ad0a42aae2ba020a0e9e2c7072e8965639173eec8d160b0c61925bfbcc1a30f896c891830aad3a733e847acd3ddc7ecdfd5399867c0c79341ee7b7ca210ce0c0cd7e98069bcd977bd92b3f19d40000000844db937dd229544d5a840c3fbec58601c9e76db9c36c42ae364b320c7ff781becb3ab27ac7c35b10139702b34ef7882b07fa14fb5f4c6165d3508c895264e00	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B1E17421-5FFA-11EF-AB78-F235D470040A} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430433449"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 50fc668807f4da01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2680	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2680	iexplore.exe
2680	iexplore.exe
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE
2392	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2392	2680	iexplore.exe	30
PID 2680 wrote to memory of 2392	2680	iexplore.exe	30
PID 2680 wrote to memory of 2392	2680	iexplore.exe	30
PID 2680 wrote to memory of 2392	2680	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b4e51b2c8b6afbc7fc5db533562d62df_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2680 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
65985f07cee13b2a72c902e334ae1695

SHA1
6f2da6dbe73a8e7d131855b8ce54db1fd8a894e8

SHA256
a59c75c58a8f2ed63ddb1e70adbbc7e810ccf53e19fb892fc0d7775cdf804bd1

SHA512
c87fb82db466dc663c254fff253463414c8090199470c5477b4ba647373b43556ac135ecd38f0700e076e17ab9dd14344e121df12ec1e78a17e55b4c25d68941

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da2607b5b7e714a626e74c9cf7a4c33a

SHA1
e25ef1ebb219f1d6a62bd2d2fb2228d463a18409

SHA256
7ef796777813956aef6f39156f929fe3d0f6cdec9b46d5346b92122620e25ce9

SHA512
f837b26790b0cbed0b390564b371ae75a623e06c75ac16f714040464c74faa47bd4848c0ff5debb499edbaf71376fe3764f5b17973d8498ea828f2fd25c5a3f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d5c8b304c402f553a7a2d8b5264ed518

SHA1
baf4cbef043fb69ad360a90b14b07408c1f9d839

SHA256
8986b75d261c259dcfb47deffc784efa3c81a0476d5c226cb5594e5b26caab81

SHA512
8b16dfd4f682fcb75b7a46a407829026f58855c43bccadbb6fb1bdb3c503f0eb860718fba989f3f4afa3629ef1e66c9e55fbc67efd0f6e0e3bd77054776601ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
589076785b31cdffd65b7c854df521f2

SHA1
41384f0cec874a8ddc99bd4b1a418c330da05959

SHA256
7fa4293e51d1c9f4d337fe6ee4b4a32159b0189e096ef229941cce0a494ce149

SHA512
a4200c7cff67b0647bfadedee22009df0d0ec5021e7bccb2c9329fc33bc4acbfe6103f5a60e27b2fdb0b2b68aa68588de1108b5c0c977903601f00b7037418f6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7bd7d7d926b71727cc418f3cee4e7e04

SHA1
8c9653c4cf68b52d52f15590740f977034df09d7

SHA256
6d6ed3983d1090b2e910d62ebed2b4245fdff0bafa175a73fb5d09f5d0b1f5a7

SHA512
475f43c86cb751fc67db57b9d7dc018cd671f7e454d01fda28b88c830a439182d99b5564c8b4d7d8da2ed310bf76030db129cdb9ebc5ec39f4d9021a7c62ea3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cdf81d3afafb74813e991f4f0842e4ce

SHA1
c4afbcfae281fffa62dce614d098b7c8f16a5062

SHA256
77d3671ed20d61d58c4091272f4df534b18f83df6439aa102f57d2a1c7520c4d

SHA512
294b95501b1b1705dfa773dc292b7764db12afc70bcc37bf96002806b85cd499607fc1c56fcf1766a6beb3ad0dfa6a9e1ecab1c89acdf38a19a4582469dddf44

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
793a5193fb32982a35e2c90105a4d959

SHA1
85d3919f91663c6ed354b7fce6f7aa40e9a5562c

SHA256
b5ce7989294cd4508121f8909925fceea29c078ef73663bd24e6d278d8b11b61

SHA512
66357b13f254c5f6a3f427df68b5fb270ad53369ccc9fc5fbe78883482567c76d4c96668e92d034df901911b6a35bfa2257bdaa847b9c8a54d5d9180704a98e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0df0ff47748240957f86c7b2a6f05b02

SHA1
e99830ad3a277fbacb7e35db66d6df7618160282

SHA256
da151c6bb47c61345d811a0d7cc902bdfb3f6609efc134a50db362839ac8e682

SHA512
46f0c3630855d0a505197152f4c66cba9f9cc2721152e0a6bf9bb2fdc7b9a561ac7ab5dfd27353d5a2ed6af9102c9de84f1da92a94c4efd29976fdf899f2723f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03839ce9e6aacc73b6fc5d1bb1b97060

SHA1
8eb56faaf4e4ecdc2503bfb5d12f7985e576a5fb

SHA256
3d5575424a30bcd0053a6d8d63893298e584bd984c563c7b206ff6a2353e5971

SHA512
1fb2ef76027bf2078d8ef6f63f2c1c8be13ada9f5b4da0e1d8fa90a42772df09ef1e5a63d36d55890738a2c4b18fb2b29c1c28fcffbec324450682b266f865e8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f0886fc386b070e367e6aac9dc764259

SHA1
7a321b4b6497005d92b734c8f28a3e748ca516ae

SHA256
39ab7f55c0681ecaf93f0b84c94dee123df1ba54e7a60025521230ce309433f5

SHA512
a0ea5ff5434b83d6166175b510e92cbb9434a0cad45159173422a74913ed643d9a5f9b40b8456355bfe40b833dacf1490bba754104ef3eff05eeb6fa30ab6f2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f11067f5974db8a6ecf441985db03d4

SHA1
9cb2dccfee0983e72d6134772ce71707a132b3c9

SHA256
2b03fb6ea6d5707dd2b4d875221fb0b02a210d3b59a12a9dba06b801208332d8

SHA512
08d326034c793a3dd1551cfc921231d666fd0b82c404aeef5f5e4b1bae51d35ae27aaf9c570647b3c55d6fc44b1648abc0d22be85b1044963551c4eb16023dd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
504d62f507cd0b3b2d706dc8d3609384

SHA1
622ed664a11867214f82ac2dda1c5e1427188750

SHA256
c67b6b1979bd4b3d6e7e9e5d942f41d80ab250cc75da272e6a557411fab8008e

SHA512
82a421a190f1b936b3e6a3d99e7cf5741ac77ae7c674c94de9e360bca70d2f69aa3477cb24dacba4bcd9aa1946f9fa9374f1e147df2833ecc6d0dc8af645f8a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
110ca196f6555e539526b2549ab5b043

SHA1
f16c49c5ed45836f31654414af9b862bc2b6afcf

SHA256
e11bdb90e68a9a0715e6b25cd6b95bcdd83d5e8f5dabed4e39cb16b989d87fd4

SHA512
68be8fb4bf7114fb6b71af00accb2abff3ead6068eff5ff37ede09316e9c1ddb9686059c30b839de58e7763fa4298c48f78c2ef298bfbd93e04c954066d76795

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9d56e7ce02c13e108fd2dfc803204df

SHA1
e0b00f2d28d4b422e467f99e0dfdbd1a02cb5488

SHA256
8cd1285a5b5fdd1aac2df6f894d079b3728a4799868f153e8bb220ae6e494102

SHA512
2a65a41e046c3cdfac7fcf0c735b6b041c0e547602e983f75fc6e3345e3698e35ed0a7e55e8a80dcaeb40ad3dc4bfc074b034dabe3971d1d002207f1272c0dfa

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD230.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD2CF.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit