2e26b585b29ad3f8448ec5c22960ee35a8cb74b642726dbf3909cf70ce36b126

Analysis

max time kernel
144s
max time network
146s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 22:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b96189e2a7ccffc2fae6a9d1c2faa8f0_JaffaCakes118.html
Size

18KB
MD5

b96189e2a7ccffc2fae6a9d1c2faa8f0
SHA1

0f62bea10ecee3ef5cbf0205c481e7b55790649e
SHA256

2e26b585b29ad3f8448ec5c22960ee35a8cb74b642726dbf3909cf70ce36b126
SHA512

4c596d5e0376c9745ef4efebb22f719a594248e0cce80a2e9434b9f90313eed9ac6700ce5fe7d338ff602476045c8450aa5f9852deba130f7105db8cb2454dbe
SSDEEP

192:VQ5cVZ7oxovwLd554ba08EFhI04YLXar4dWZSj0VuPfKuHciXOdJgU/hLallNK:e5cVZeNzeMt0dWZSj0VuPf0EK

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430529051"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0ccd61ee6f4da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{49B38431-60D9-11EF-81FA-CA26F3F7E98A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb47000000000200000000001066000000010000200000008ae3a0f580d60e37f8c0e4d32897816051b573c6150c43305e646334e47039bc000000000e80000000020000200000005975d46eba3c6e5499b9b194c4cbd65789c4c5418f6065bbc46101b5902a2eb090000000dde6b8c53ee417c2f876610c54d12dad2f701a805bd7b46b889b88d8c5265e7047398aa0b08f2418cfee08e321730eae5fe59f0bf91186aa068814c51ecac4d904b09112aed09af576c18495b52eddfdb6b42d0b97243124549cddd001116eb60ad4097579194e6cffed25d44a8359488a0fddaeec270f56d7841172982095085f8a1681151c578af99f7b08fc5534b940000000bcb0497f2153460df60be4a8521c433a19d72ef2733f20e22ffa9e9da5541ae6919aa6015c153573909fec96324f91f26d5abcfb5e4cd957a2c02d8c025cca46	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000a3d5a058b71c4645a1a6b8b9d2c7fb470000000002000000000010660000000100002000000037ec5e809703ebeb52c6f6b5b75597173e37622aff13d0978e307073cce751e0000000000e800000000200002000000052ef7624ce7d0b809634d4db3e65a1c93dd278d77a1111490d99b58cd3c68be320000000cd943046097bf8221297fb22f16c93e902f44ba21c65291ac4748b79a2de64f7400000003d4c89de568dbdfe69c5f88b2bd6a03e31f4353afe84c33cfb50cab5155514b2a34cf01428f3f3e1dda15b27950cd00f83b168154203d8e99b45315c1cef7d28	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2160	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2160	iexplore.exe
2160	iexplore.exe
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE
2836	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 2836	2160	iexplore.exe	30
PID 2160 wrote to memory of 2836	2160	iexplore.exe	30
PID 2160 wrote to memory of 2836	2160	iexplore.exe	30
PID 2160 wrote to memory of 2836	2160	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b96189e2a7ccffc2fae6a9d1c2faa8f0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2160 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2ced2dc767238052caa2a4aa0970b177

SHA1
7711ea12f8b0b380d353c8391ec2198b7cc313cd

SHA256
68b9ae1b58b04ee86f25e1e3bcc83995f19000cadc9276b5196b0c897908d5e4

SHA512
411c21004e12b2613f22dfa2b4fd95122f31ea05b1d782e788f95ca6908216480d7130998d01c2243da8ab406716543943ed5f79942e16e7c082f1dff4645ed0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
446251b5020a986ecc37a58517685dcc

SHA1
5d4333e72994ddd586d795216737a962d8d5d80a

SHA256
2b2d7ca370b878f8b25ac7535a4393081649f571e82f653d01f7e3223c66d155

SHA512
036d98abf6841c531d2e96237bb8dd20bc05384988cf533edb03c42bf8a59d911e89dfd5ed9e23b91a2183f5c35064e43b39b516c02ebde5b2dba13956c38bdb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
aec4b8b0208bccdb6143fb4b8c6acb5b

SHA1
0447c491fec1061aa06d230ccc9747853bcb8ec7

SHA256
e5e737ff373a8d912ace8abd1e8daad097baf8a77897cffcd12be760e591d8f6

SHA512
dd3aa120ba19f5ea78735441d718f4794beb34cccb1bad438020b162896e6f82f8aa9fe1d13822f4758bb527f31d986c02efd612de5e20ade7f27288e074d4e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3278a1bc7afcbd1561fbc6f20e0d7187

SHA1
cb88b5490ca759a36458e8b8d4218ed748533fdc

SHA256
404e65e1aa936a116ce513374b46ab84583a8bc86a75eeda74ff1839d5e91183

SHA512
cff16bdbd7af42fe98e6a94d1935d25430671b26f6869af80b569a9cb190e79d3563f9fc7bf16013337d41827c291e16646f3091927a07c68703f55a5c1cead7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
52175d8605646dbb16d73cb60ffa48ec

SHA1
66fac229ba78fd2effba5a1919079d442ff5cda4

SHA256
9d3ab7ec91fe200b143973eeceefafda24d064586f045aa863876cc9a7c3cd28

SHA512
be015b2f4aa8e16c27aea412ee85c8476d718f74ead987e2a3b62f8f51c2826aa8d96c42828049e3f2ac93f27ec2bb4ab90ac0f7bf291b317128ae4617341128

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bbe1208809c72590585bb06ed0e68a3b

SHA1
25d29a0b3dd1ebbf67f78c26694723dca61e05b5

SHA256
2b290415c8770c006fad3fcaf8cb3d734e7432ca6df84c30d732c85598708e72

SHA512
2259389039af0a43e61b52e7a30c078bae9bc46656551c51bd2bd1f397aebbc9a0431f3d59e20f883969f17e3a4b98482056e9cb635443bdcd03d09325666261

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ba9cf8b883a8e6e8b47f81910c25d182

SHA1
0efa5d0ca070fd33c08d477aa0bff9ca3cbf2e15

SHA256
8025bfe1d1a293c234fb9f8fbb982a5c74fcdd0d300f9448969f50e94c3104dc

SHA512
4d16f81d883888739f6fc7c77c64841826f8b4d83b619ac67a761a557489b292622de95f4f1d12d4d675d3278f394e0411c58defe432cb6614c57bbc386f7cef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d3fb1354cad22f6274c90c9ddd27def

SHA1
a7a7ca4557bff3d26dba94cb06814b2f088c0d77

SHA256
2e414a1bd9b2f11ad68512a9fbbf2f88d7d4f7d58382d738f8f50e1b90047ef3

SHA512
f3236ed5ba96c85c08e26e4715406d3d58b1fe750b944743098616e694ed1aaef5808d9dc379d055747e3d38e6d0308b66a40843e9235f8674ddb556064a8559

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9c1f85cdb1d051e888b139dac0784526

SHA1
7450cac8cd511b51da632e7bf7a5d9357c57b6f5

SHA256
1872aad4cd16952e2576d65ba7877ae47f5d3591cf2fdb20af2e9eb158ac73fe

SHA512
c7d7420c7472391da3f6b9bdd0e404cdc2e4303c33eaa26c696726dc3f36f8e3ea6bfbd4aad37f42600503eedae959b77dd50f0f4807f6fbbf66e07c1fb5afdd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bed1d2eab2b6f83b968fcf0123f15adf

SHA1
f314c6baded34f5e68545a03fac85422db6dd07e

SHA256
877f7ed8f938ec6386ba6f7a2bed9abb6890a58252780497bdc9fab2d277d9b3

SHA512
6f1e1f24e8663cf6a61dde41cef49bc4022d282ab03546dc7135db7fda58d255beea0b1b58802a55b1c9da868bc437350ebdc0c5b4cf9da91e6e646004e32ae7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8559.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8B93.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit