db99c912262be5b6b07ff028c157a4a517a982b3834d92dda45a5fc90daff20f

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 06:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b69e2dcf1845ddc00ec47cbd7a20e805_JaffaCakes118.html
Size

121KB
MD5

b69e2dcf1845ddc00ec47cbd7a20e805
SHA1

bec88c3acedb99efd94f3c93bca960841bba7d5d
SHA256

db99c912262be5b6b07ff028c157a4a517a982b3834d92dda45a5fc90daff20f
SHA512

2a39d3323c28247f1857d713ba841d68430a0b002d51055ece251fd80f50871208b035acc46b63b1ea77024fc8fbf17508ffa9a88ab4dee1ceed72f5c5926ec4
SSDEEP

1536:M5qIkksQg7QbVQLGOKBFMiGqsQ5qlYfipn8/VTIl9ZS2hClavcsLhb8q61WnNW68:m

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 1090152e5af4da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000e7107d9a03d39b0017364f2307f60eee5dca1e331798bceb0d138b4480363379000000000e80000000020000200000001ef0fe62d96047ddc5ceabda64b98c5b620b70542b13840aaeda65f96b91beb2900000003ccf66989adfd81d5d1e8a0c71d347781e3eabd078094288c827a0ad366c526a3f7b2da1e77f69c87e490d4001a5c5e43eea87913ae52258f4d4ecc9cb4d481f69499aa51471807ec86192a6dc31fc1402c5f8e5de746c2cdc99993ed3309bbe72b55298dce3e4977872334b3f817d82b343a4c55c00c50ce0c5b40713996c4316cd5e848d902b10cec8a4980a50547940000000c6b5eb2dcff23f61fae770b2478d1c14b55978bbf237a7b76a913d5f1ff8c6564fa92b9415cf6369466e5032cb86034252cd0183a0adc0c0b48b26c2a5ab0e48	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{598B89C1-604D-11EF-B6EF-E6BAD4272658} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430468947"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd000000000200000000001066000000010000200000003f014944fd778122dec78e5fccfd215d9674cb3c21362b56f06a31ddf574eafa000000000e800000000200002000000078b1900237a6de3c1e166892481098b3f9db14a09ed9c2337ce1e0081429f0e120000000df3039e8f7330e02212377f654fbc049cde32cf8f34f1b611f0e361811a4096140000000fdc0e451d4b528b930b08225ed96c3c52b2c9fefa170c5041697129ba2951015a9d2ce4077448becb652eaff21f797512bc6fb53877cdc11df2bea7ddbf152c5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2348	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2348	iexplore.exe
2348	iexplore.exe
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE
2784	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2784	2348	iexplore.exe	31
PID 2348 wrote to memory of 2784	2348	iexplore.exe	31
PID 2348 wrote to memory of 2784	2348	iexplore.exe	31
PID 2348 wrote to memory of 2784	2348	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b69e2dcf1845ddc00ec47cbd7a20e805_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2348 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a553414cd7ecb12c28c60cda20b027a6

SHA1
8af7a6d4b32a6f31b00ab08252beab4d40cc48f0

SHA256
1d5bbb4cf685aca7c82883214b29d195a5f21e91b1f5b15fb2fa2205dd0b079f

SHA512
5361c31b8a021114a914845af21b282107814178689e80bbd618bafe838268870a49c9fa95221f5b5e2ccf8b7669dc2181a8237d2d08588f387802def6c58226

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
08657f7646a2e9ccd6b6b6f56625f144

SHA1
880798acc9b9d13c20fd5dfd162dd05faf39afb7

SHA256
67cb264418ee4eb16c99e5970a2b7dbffd13c3b7b28ac01e7020cfa2bb77205d

SHA512
118ade2141eb5e36bc590dad7d1f769ba0fe1ff41923f60630dbe4372aa02df0fe47c17fb89f591e36773f0dd8b1957b5fb49c3aa2e86b753cc9e60c7473526f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c6b8aa3713918a4fcb7425d4202d7740

SHA1
9351d76df7bffff8fb161b49f83899bcd51e186f

SHA256
420c9dd2701b5599f0cd9dd042c93ee4d1b80728bf7fd86d27df74445bc7fe81

SHA512
c3c3040e2ef3ab380a64a408cee44e6f658c2ee48f5f784df0ae997a4ffe85efaaa4143879fa400792de4eb761aaf2b54156f71f7560790568ff9620cb088e48

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3bceb8e96c99a4df36f6464d569abe16

SHA1
068ba9b2477339839993b3f5dd08c2c7b658f42d

SHA256
10ecb30a83837e623d60186b1f71160a5526361214e3d246c26701bd4996f127

SHA512
92a7870a761b7c5a19fb054647f478afd2599c0772c4a2e07f59839adf401d744e05d6634622cb3eb41ce9af4888a26903ed1450fa087fe4cfdc533fcdc0e5fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
585c5536d5e8279aeed2757fc31e86bb

SHA1
57dac7fcb54b3ea60b4866c2fc89ab6773a9f4b4

SHA256
cf14f4bd4bb8d5a3b9e32db3facfc3352bee2d3e905c46e5d1388ada3690d98b

SHA512
65e47a21be43ac27ec0f88412ff99516f00b913ddc7b6cbbcd7daea754bb3ccf7270a98069c5a58cbbc9f0e12cb1b0275e56da1ee36ef308bd46ed3a089b2374

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
730425936eaeab54c0492bdb9a98f70e

SHA1
6c1519514cade72117499bc0a6fbc005f573d26f

SHA256
340e65ad307faf2d5e994d399ff0f71e3e9e76c45d1e030cba2876d3a08bfd1a

SHA512
dfac4d7ec57eb746588d5805f6534b310b099deccbb754ec5ad42f1d9299da525077eee41ee9edff872f3fd8c87184806df4f2b0b586416373b69b774d074169

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c0f78f85bb984aa6639cbb73fd05456

SHA1
1f5dc859896096a1684a353ce8170d8392ab9a69

SHA256
f5353857883cbf5ed0bb32f6c59b09657beefd43e390620b2ade835bf1ecfc0d

SHA512
a1ff55702c19aaabf2ffaae03685977995efbbc53d0ad3012859475048eb5fe3c6046e4bd98e96f440d9c1ed73e0b0321681fb1f4c411168fe90789a92fe03ca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
625244cb0ca4591dc10812f43451994c

SHA1
f4559a1b982931d5138d1c9cdbd4433ee943e23c

SHA256
bf0998c2bf96c867f798237e2f621ea9ab27d28d109b2e1c48d2cde8407c7b39

SHA512
c8e6616eac71211387a372b9ac5459384cd038ae38dc2c6da44ab6dc169621fffc22be1d5402f3e442f73fa82e9d1a3abe4838fd548c0cb70670974ea2e563b1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ac3ee556b9e6b471ba018b0075564308

SHA1
b14ee4d7d8ce58eeefe5e6526b752b8608bbfc62

SHA256
1dde19dfbd4fb5eca0086b22077e50577899514d698cfab20314475109c0ca89

SHA512
b60c6e91637044dd3751590e0d5a58643d47e277e5521319729668b0c0f4ff204f1b7abd3668091219787b35239449beb98541c1c64570ec5cc06ce8acb62ae0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23f2de817dcbe5e68811bc463a90df88

SHA1
4ec14b5a8334af16013169cf45e7e61e6919f481

SHA256
fa9fff9c65f8e18b1a91317e6c4e07b69d56023be1d00fe757aee05c2832e073

SHA512
df38f32cec86b0f1b37de20d0ef51870614154d3c376c415ed164a9f2a99ffaf34995a9648b2f33d706022b7097965482ab473312ce1ec054b4287d5a84f1e19

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51d187f2b5e280b1ca2f2bd82f275a3b

SHA1
6df07692aaa871898c1122809b027a6451b31f6a

SHA256
56115af847d461162714483bf569017b933fc220402dfc28fe9bc3a988c2a301

SHA512
1f6ab068bb39a3d09ccd2866a09c9e8f4af93eb56f432ec3c092674acda7f13a8647837365246966aaca49b8f3ed39dcc34ee5d5650e3b7bc6db47d1eed04169

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3ec212d82275c4c9c394321890b6efab

SHA1
92d6a6a09b5a22efac4d7e0a59f4ebc058d2b896

SHA256
25cf669b03bfa4032a6ea19f5bae0803708da427df9868e0694a2ecc82cd0847

SHA512
3fd62a46a14b3e0e4d4b329f07e60a06d85d148922e1bc2cf7e8680032fb6d1b8c5abe95405e3a0e8f56088fc97cd97e66191deb13b6c2bcb4e234216f6d3672

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
05eaaaf8db7047d89d56b3b84dd0fb4c

SHA1
d0408b4c8c64e3e9ed4a69c12ba13167ce932610

SHA256
2bf82843ae8df10480e195fbe8af34cd22af2e50a2a5b420d60256344f9dc74f

SHA512
33e9ed61da578dfa5117f5523f457d9cd0327c7bc2d584e8b79cc1c107387ddecfaf63b3634f2438675e0246730ac41264da874ef91b21b5fad0a3c2c05b56fe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ad88907b83fcf8a987f73208aaabf3b

SHA1
97a2e0b160f8fd8982c549ad20a31132e748202d

SHA256
11c8ef67fd4571b88db8dc4b46aed5fef6cf9caca046696a5987ccaedae40054

SHA512
e2861243cca0df6aa085c06d7123a93380ba33e21235acfebbb1a66205cc7fca34466c761a42b3011f22622adac291c6968e9a3a1792a82a5005d354526f45e4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a5496bc25fb849aa2d54971d21455f17

SHA1
c42b40d1001983187b111c41d52d8577d55aaced

SHA256
53eddeee0b898c3f24102e2aaea1645a1ac104c6ffa8e34ab3e7b53c1a54e0f8

SHA512
5714103b8ae5cda9a9ec2ba5d5fdc147ab5375af685bb665b07bbd69628c5216eb7b6d4cef396cf9b757323e30cba694603327043ff50dcd096536a992c90b4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC05.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC75.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit