5ff2693d03148c0b3e04642ad041f15df9b1672c0b1de070aa42f401ede96043

Analysis

max time kernel
70s
max time network
131s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 21:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b514425b35308e007a43d4c385c69d0e_JaffaCakes118.html
Size

64KB
MD5

b514425b35308e007a43d4c385c69d0e
SHA1

c99c2ab95b4cdce4a638a5dcc2632caf309541a3
SHA256

5ff2693d03148c0b3e04642ad041f15df9b1672c0b1de070aa42f401ede96043
SHA512

f77e2692fbb34d76047607cff3dbc4c72628a3751e19c2b15c34784044a00c4b17de0257deb3dc98697972b91edea018919e42908f8690be933b13a1260b9c2c
SSDEEP

768:cdif9Gtexkbix1Lqi6ZUDDIqqn0CM/YxtI16GKL4J+D/Lh++WdWogssT:RFaxboqgwMU

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C7EF0C21-6002-11EF-946E-F64010A3169C} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0b38d9c0ff4da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430436924"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb0000000000020000000000106600000001000020000000666baa66eb705d65e22cdb8dacf65e02d69a4ad0439cdfde2764e5ac2052a7b3000000000e80000000020000200000005c069059b47c3674aa40df9a7f9281cf884962a7e6ab9f0b8ac55a7936f9743e2000000007a0374b848925c6b9ee560c71e557846fdb5859799c136accaedd104b995cb940000000df0a04d1522d6b022d56c158abd2d938fa69040b2df98e77eaadc860ec6d5651be41358a62dc51b114804ee85946deb46c37a5c622e449669173845c81c70cf9	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000007afa8f83cca0953503e3890b93118f9fedd222a8601c404738d6d49a1194d62000000000e800000000200002000000017c17a0dd5710b72867d49dd73b13e8a94d73dc1f00c59ddd11aa6edf2e0ace0900000004892591fbbf1d70665c4ed7e3badf35ccbc2af6f6b4f951bc06d612e2357bb633f9c68870bff4cb8b79ab62e3fe350419b0cab2dd361c0a080ca57bec85e14a93b424bb385ff983d023f7d8a91a5317236d7b37a21b4ded6d68c5650d51d2382340e0227149d9dfbb6410b3bd0b84373e81092cb2833e0d6598582d9556c733388765e91d8967dcb2e124e480f2ed141400000000d38c7438bcc6d537be27adf2ba2735fe5eade5c62d6ce3eeb79a3ccd24b974852408927b2693352a8cfd1b71e36e6b1ad3e7521944c29349104415b4b8a5f74	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1756	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1756	iexplore.exe
1756	iexplore.exe
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 2540	1756	iexplore.exe	30
PID 1756 wrote to memory of 2540	1756	iexplore.exe	30
PID 1756 wrote to memory of 2540	1756	iexplore.exe	30
PID 1756 wrote to memory of 2540	1756	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b514425b35308e007a43d4c385c69d0e_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1756 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e27a02e3adce321f02cb7251d4daaca6

SHA1
e0bb6f9ab91463aaa03e1c3fde8ddc42ac539e31

SHA256
84a7ecbed749ffdcadfca4d3a07e36470a35121f48b551b4dff80576f5dec7b1

SHA512
15e4dda27c35cccdb5904f308a714551e08e3f04ccd6cc52f1bab4bd87a2b14007cbc567c8811d0ec2d9699357fee09932f93da2e91708674bda37733037be4d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
549eb41059a6a4dac3878962fa6ce64e

SHA1
9335b378bfeac61981f7bab7f676fe1342962c98

SHA256
3355e7bf6829045d5979cf6bcdee7d09f257d3e94f614eb12dde62a0aba4ded6

SHA512
196f57f85ff41a00ce5dd1ce9a0138883543a300d3f6faceed89063f553a40c2045a78de566217804bf777d1bb8219ecec54f640702d3208739d99edf414e01c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
825c676d0aaa070b9d046fd8cd728963

SHA1
c5592d1d15e0c7f158b49a6a233be636d460c982

SHA256
4759504bdc858ee1377cac22734be65582fa200f7bfe58529611ec7b743a41b9

SHA512
603528edbc77721374890557d3b8470440eaaf3bcd77a3a1b60a2d3fff6ed1faba333da788840dc991161ef9f0c6215f1895a9a20fcb254b9d39dd214d93a17d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b950d9a312938fa09c50bc5b7913ee61

SHA1
8df95babefde8131b41f2e94e515050b75793529

SHA256
87ba387a4bb07270f9fed49da1d6fc42fe2bb9ef0ca4e59c24fa885fcc0f402d

SHA512
c656765e0ab3a1a9efc08902cd7a66ce7aa5725b4f6aa7c71cd28e94f01af98a37540309a816a0e5472609d0887ee8b2b899bdb5b0f42e415bc36966d5086e67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c82ae3e754d4754720c43008dd8a0b2d

SHA1
71def99f3285256b622373896d5b222c2617cecd

SHA256
75a2b1d08fa32d1eea7cf22493aa4946a2125c380f1b40a964be12d0e03310e0

SHA512
de6ae9a15a98ca8b1720c6641c6056427e2263b9a40e7694f78355181d61580a9b469ef4ed6b351b99673a3962065d0844cd26a0c2742df923bbf6965bbe6767

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca442d7b5cced691af81d865448c2477

SHA1
623e6d89d7054d618f05fe0e4067e3a49cfcc337

SHA256
7ed9ca035e6059cd78bdb6cd0aacf8c1c1967be685c661849584a82e109879bc

SHA512
489284f8f22445ec6e5828222c4b2729ff4bd5c7c74ee1e05d995f8606339cc91386fd7c5642bbf95663ec44b33d4b930b63d6048a6253b48fe5d32b0853689e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
946f053b6c57d1ea5651006767e80946

SHA1
b4e91b0e88d5e8611d07205890e624190d98c94a

SHA256
0d5dfdb7be97a3602e3dadf4488f5c64faf515a88aa34dd57d89d490e59a4430

SHA512
9709b0896db424253030349f172a2982051ceb03f9b5713f5850eac42a9e8e2bcdc1770947a792d878310bc65ef8ac0be395eef3e7365812c933146bfd4be1e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ad3f20de65f61f1cfa571c79ac98263

SHA1
fd3b44c09aa3a667726d3f0ce3256b310bf2714b

SHA256
53579c0ce959f6e12bf0a7fc829c7fbcf72d1b64522a441bf6b93a1e6ccdc3b6

SHA512
76a37c9ef77a7d30dad5d3f47c5550e4240d87d52b90b0be96fb177214d3040a4544e7141245c75b7e114491025d667258569ae5d7c18048419879437237c35f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a488e7ffac877db775a629f6c26276a4

SHA1
268b521a9f0a9ddd224817c85d93d360666cd23d

SHA256
22b83a40fd06a82fc3484c9fa78c2a364b98ace86037ccc4c08f6a27730c5f5c

SHA512
c265e80191f51bdc0604b51557731c79decf9d24980684121ace6aff808fa29849e65a012dba3367f1576a3d382a4f1152e328e4e5a40243daa1430d05762d88

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ee01ef071388d670c5a712f665820f5

SHA1
8671a15002915da36fd6c09da58a0e5aeb1de6b1

SHA256
8b9fc2afd4d4cebd089b0eb5007b4bcc34c646a0d4a0a678fa80e9e909f55927

SHA512
e37409060442231d858cbc50978503aae836167cced78e0f1a71dbb80c8a75e5a4ed4915d9a2dcb291350186a8fb30162750d1bd570a5c4f9467960ef5c11f99

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a993d7626373eafac51104414f9969b8

SHA1
e784b38bf21f1678898cef8e37d3735ee00051ab

SHA256
c3ff9b32e6a069273a9e1617cccbde369a14b4cad46f4580b3aa81e23dec484e

SHA512
9d2a27823763f47357e2b6a4f57154189f7a78651d4e64ba2f47603a195e58b0b7b017e3af51bcdf49bd947edbc1bdb05d27718f20f58b583b63ad3689d25f4a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f770e4e54e0b91d002c8c79ec8b4342c

SHA1
d141f6ef33e7972441be34a7d479676c786faba5

SHA256
9e75cc2227ae708062c5b773675286b86a4d0804dce2a0f18c602fa0c8e8ed7d

SHA512
54716044bd5f864bd6a3e44732909e2d291d8f744c44acd1b7b21759a70f855c5c57c9baa10cbf59a9d8e2f10411f32196c49d2609838e351502ea4ed5fba880

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
48b40337d134756e12a3427fd93fd461

SHA1
f7c079d698d8a172187312b6da878969bf04ac9e

SHA256
e8a405a60f9984761f8c5cc1c789597c6a392364ee6e57ed6cd709b82b8e13f7

SHA512
09d8bb10812e5d09ad228071811cc05eb3e2d57a872434412eb48fa30b501d8f9ae9a90f385d380645168d1113b477e68807d7049dbb2a5c60e6403cc410cdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a71dc3179d9843a7147315fefc35b3e

SHA1
eec485297085ec101b859dba0ccb5e26eff0e224

SHA256
82af353a750c94a5c73f07b6caba9347e8a85da2c5cb82bfd456d686f3057845

SHA512
f19263e03d4d3af07eb45418027363cb746b30e6130fe9b9475b00840d9ac8fcffb75c788fa88ab10ab541c3a28d170c5a678d508fd24fd466ff69c9aa8c1455

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
800cfeb916c3888f7b3768c5039b327d

SHA1
2e6b0b3e4764923bc2aff3969aeb3508fe8b24de

SHA256
cd1aec62594b000633977eba63bbf972c2163bd25e447b68dcff8ece6415e525

SHA512
edadc211bb2f4d51954f268ea13e66b6dbf4f3e60a9db5d5c2b74e8153835b557257bdd12c2f993a14aefbd68c53931529cd5dfb43f4a322ab2ee87b288f43ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabE4A6.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarE566.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit