f2caf9045f5918421fd483a5d63124a9e84912a3c24108d5907642127b4fe835

Analysis

max time kernel
85s
max time network
146s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/08/2024, 20:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b4f5986febb6e9c6b0821c6361972e4c_JaffaCakes118.html
Size

956B
MD5

b4f5986febb6e9c6b0821c6361972e4c
SHA1

7b0d1756b240bc9c691daba60dd2603bb9537a3e
SHA256

f2caf9045f5918421fd483a5d63124a9e84912a3c24108d5907642127b4fe835
SHA512

57e360af70aa54396fab4d204ea570f63024ac47cc29dcdd5681b7081ed1f79e169007e068be57f8a6bedc6d50846409e08770faf7e8d75e2efd7b0ff6f81661

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000078366529f3bc761866bde254e7ddb71e9afd4315760b8f04424081780428db38000000000e800000000200002000000005b4dc51be71889c6b9674fc44de40a83450db4990ff4dce35685eda8b9eaa6820000000e6f96f52bffe800d658950c6eb3a5e6ecdb3dc90dd789be8e0e21dc1de463c064000000005b03add3f5e09394e9e1458f674546af51b337c5a175bba5dbeca46eb7cb8d966ae53c669f560ab872094b8960a490f495029e154a97e69227160f4b363ac9d	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6719EE61-5FFD-11EF-8E5A-6EB28AAB65BF} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000010ca97761aabfddbfdb9dc54f0f5d955a7881881993f99300d990a066f8f3b5a000000000e800000000200002000000051a42435e91b3cc5998d971f23480f131bac2e88e98531dfcabc853e34194f3c90000000f6db5937b7cbd61d32efb809c440f276d9d142ab6130de91bc09b8811e6a18addb10d32c439ebe44e52288396240911ee028b59c925d4d8593bae679a7c09dc9bd35722c49ef44b1eaadfde04d3f572c9d318d38d5135c0318eb23a97a8172469608b91a95bd5e8b6b81893e1e6f5671d65fc5747bc2264f36373058fb6335f5d7b7d1c035e5df873dfb3030463599dd4000000065665a73624417783690c530b80e79c5533be76d1e784c25d90cbea773299e578236821c038f2fbd55d4d54d205e99735c78a0fa6680811a13169c284cce96a0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e04ee13c0af4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430434629"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2876	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2876	iexplore.exe
2876	iexplore.exe
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE
2272	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2272	2876	iexplore.exe	29
PID 2876 wrote to memory of 2272	2876	iexplore.exe	29
PID 2876 wrote to memory of 2272	2876	iexplore.exe	29
PID 2876 wrote to memory of 2272	2876	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b4f5986febb6e9c6b0821c6361972e4c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2876 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
e2ca4adc1560e7e6b0cea3adda18bdf6

SHA1
5dd03567a3acfa0452996b4da1bb55b7a5dfdbb5

SHA256
23cd60ab347152508d4512dd315ff142ace4e45a9eaed63494613bf68cb37ea3

SHA512
5236cef582e090a5b7208af9825693ec7f735dd5c3d365343cdcbeb62fa0bf357fa35ae7d559fd45f8da0c3e773a90fbaaededb906ee30c3486d7efc62f462a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b08f352318ded9b580bc84f6e92a34c7

SHA1
170104548ce53fe3c5de5e0a500969bf1631f212

SHA256
0b26e9877c5cc7e8aeb9965ed3cce8d5a22a51159546ceb2699b78dd6c5ab72f

SHA512
a51632dfab73d7cf82b77d64ed1b3f664e2d8e8ca9da2ac6b2531c4aae5a31750d3c4ff471b16ace4b72f6f0c2ed05628b3c987c10a01a4861a9726b10fefa90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
340c07d1b679704863d48badfaca6516

SHA1
ebc319dafdc1f60abfba6bd70819a47a584e46ae

SHA256
237184c74912825a858dc036abd5c454c9b18cca9e4af9c96ffb44e05ca5232a

SHA512
eedee9a47e0d9dde90a7939a12827d39e5489596ce5be9b9fe5068e5aa9a21baaa2eff49ed705ac78c50f832bbbfff5100616142177eeac1aa71dba5e8c047a9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
13eecb18284a7e6a1fa6ca49d705f84b

SHA1
a16dad1e0e446f6ea0cd6d6bf2e6419794445a49

SHA256
e27d2a96acb3dc7b14bdf821830276fbe4c305495da0df36c49bcc7ffb00516b

SHA512
a3f27b70a02cc9775b713487f036f3ad08ae8dd4a75206cde6915327a501a32dc4bd36051d453725c7cd33e62800e62f455dfa185a55163857924cec59b776b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b75f3022b1765e79d9ad848030e2c18c

SHA1
8ed4825ac35527487cfeab74ca2c9ae8fef51665

SHA256
e287e106500f2dc6f39c736eaeea36b2acfcc321c37a52d950aa78b49dc254ce

SHA512
8453a5e0505ce3c94057ce6a5575baab7c756d6543dae1f73999ecc759f3a3f2604a5bca9d00d4a74a95d9da7b3b353432c2d1534bb12b910f8fb218432e0c00

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6548a053528470374e8d94939dc91dae

SHA1
97b98af7003aff95734f3a78452cf0da57386e13

SHA256
25597e4b9a38cd83d254d265ad4e2c7d88f31406c551193857e7e906aca06ba2

SHA512
0ee81a6c5598e9deb0d795d03497ce1bc4fea847088803884a1065628ddf1bcdd6e0289a02c836f75225051f663b28aaaf78771fc15aa38c0072875a534ce005

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a6db12d476c035f73751cf8f1430fe5

SHA1
d690d519555cfaa436150fece630240b04eb03b2

SHA256
e6941136a74d263d148cb5887bc6732f1785df0cbf4e9ca93e58c2becbb118d5

SHA512
e80441d17ec21a6f4986b80e77dc92f6fc66dfa96631953b279fe02ef80942afd150fbcf79ab2639e32a5ca829cfc4cff9eb0f2caf9066d7b475fc061a853c51

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24ec43a51ce4c37d618c8a2858638fda

SHA1
b182ce22db7d733988c64042643bedb4dc95829b

SHA256
30dd821245458e93e90525d5cda9bcf6a08277ddeb33207087a47a91b3024b3a

SHA512
44cfb031f106cb99cf667aff87116e3f68c4e5c3fc5c3f378f351df209c9ee03e5e8ffdbc461bcab590f2ad427830b169a0fede240d5d98bea40827b8da3430f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b51e9f4be9f8cae80fb08aa2c5770988

SHA1
e3184e891022b5820879bc9eefde9cbb1161d420

SHA256
7912a0b52772bbf59292dbbd56542165d02380cccac2e76f8aef713eecf7d242

SHA512
55b80963d6475672f33f6769a29204c1ac3a42bb5d02af37c0b1087603ed5c14f53214adef54c8c6dcea6fd59be835c0b17ab8c7c51684d0d195f0073f973958

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3e3aa6fedcde5212a69a7241ca7c758d

SHA1
8de5ea2f9e432b9364ef81e6bd0700ff3c8370f4

SHA256
722b2023d3f06e2ac3fe8bb24f5d7bd922e0b2323a0db2b46965e7d31315780f

SHA512
734d6991208e164c52a76aa772be69ef17b61faff7b581a0fe3308334543716bbae99c83927d8b7964fb9ce43118051fc69cf6231c0f01fd34b517e4730aab7e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0680ade8d62c2f32f58b2887ac64fd53

SHA1
7256f2f6ec22f9a078a033f3d0b3831286c95e2a

SHA256
3eed44986e58c0fd92f24b9492bcef84cc69b2284dc6ac782601371a181a017c

SHA512
cf7178a0f8f11484bc8dc08f60c254d1735fc2f5f6e9646eb0aaa83d9f35fe4f530f6b3b9561fac9e590fb89ea480bb32a376f4f505bc811c80a3973c60ee819

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ad8e3c8280ca1fa42b7b8f1ff2c85fc

SHA1
34955d0cabe5667f684b1b82489f2f337a9e93b8

SHA256
dc1dfc6247e94f9187911b5f1800ed92808542a62854a34f61eafa77386f35e8

SHA512
8cd3bbfcbf55cba88c3e5ebff309b6fc6ff0368a8e637e978608a174a30023c9076557be8bad7145ed364f510b0efb19b5a6fe3c618cb3e7734bbfe9ddf353c3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
38911141c4a878be4211665a64b63326

SHA1
01432a565fc965f28a05af0884849df938835b99

SHA256
c5130d4025be955f29d37107ce6e2890e1149b366edbd58e88c4cda98057b2b4

SHA512
3eea998d1260f16fdb310e0d866138bedb7fad3f430c7f8c697fc8bb9a538004aeaedfc73bcabc4b3c54c8f1a9c5f2dac12546aeef801f0d57f1565a08e899c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fd7d7a7a2dc22f6a431fb220ea73172f

SHA1
e1c688b1e678d5f89ba1539c9a301c6f2b6f29ce

SHA256
739232c92c35bbe1212f0609f03b6eb1902cb0f466a12a16e94a332afd153d46

SHA512
741bcbe4909d21f7313df1d54959fdc627fca7902ee8009bf7ad06cb8a252d6e1ac311ddd3aa44217312a65980d3227ccc5bef104d290c294a271478909ffbdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
9672b1670d887b50075d1c76ce4abe32

SHA1
1d61276aa57d28709815eab479ed8c39474b4ef5

SHA256
fd01e70bdce79838110a4c2eb09ffe6b88b696f39b3b42ebf882b0378d41c326

SHA512
6e854db7134bba60d03b86c7f482a8ebb40556ff1a2c51541d8879bdd0cfd34355cc21286fe42cdb278dca7dcbf1aaa472809b19eb6eec8bb059094b437d7aa7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabBD0B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarBD0C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit