88723d955725a0459f70cb28330144e3ba1a151f2ef80393062f867bc04c8528

Analysis

max time kernel
141s
max time network
142s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 09:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b72ebe25bb4cefc7ba438899aac063e1_JaffaCakes118.html
Size

76KB
MD5

b72ebe25bb4cefc7ba438899aac063e1
SHA1

6ed9891531ce907b2ebec07d84aef6b918b16021
SHA256

88723d955725a0459f70cb28330144e3ba1a151f2ef80393062f867bc04c8528
SHA512

cf330d6c96c0efd418b42473e01d0e1c5ccc62eb09e8130ef922af2acd2dddc873747d67f95529a10fed23ea1c1cac217da5749ff044697268983a048b34e3aa
SSDEEP

768:bgOriWNcaSoagG3o5OU8faTpsZFhVwNRUfFP2Uq:s/Fo5A+psgRUfFG

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c92000000000200000000001066000000010000200000003777e5a2f50bd92643a31680da0f3692080e8abcb92601e583ecd67a213437cf000000000e800000000200002000000050746883c2d901cdd5dcbbad74d49423ff91cb8c2822fd0cb4d9992e2dff470b2000000000e70952fd0c1bb78b2d24bd46abc28cd6a7cdbce3d067197b57e8bf80ef5eed4000000032ac70a1c9cf64428eb9731f1d5830fc87b94b9842b5faf1be5a2e8536c281a1018d7054a0fe8c41bfac0a0ab133412f00b5dac39524905cecb9e0f1f13f38c0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10cc5fe378f4da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c92000000000200000000001066000000010000200000004e712fafd923880cd6cdced889143ef16c5aa6a9dd825149cb4b0093f3adae37000000000e800000000200002000000019ba5e42a446af327cfcfd3121f9833a279145a6eb51637ec8bb2e47cb1234b290000000f21936b74befe9a4e161f5a5d902d9830d3a45bd0921f63e6b9778a2b37c6e0265d6c33c5ecfc7e6a47c4a36fe12784aa9d8b5518588942f2faf8f1b7be52e7076315bcedffc0bed595bd4b8dcb54b5b1c218b77571a96a7f06aa31955d67a68fea919a31c1c50a2dd0b2d9a1b0e0f1b13cd2eb0c559bc90ff4970138933f5613c1da6683812fe18214138887dfb07034000000052707663ad02e956ce38e90bbfcd65835a55cfb074fb23114b7e9d9e0e02906426ee31ba4333208fe90bb9a53b67d3fb87f040f7a7904523cc1262bf10848827	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0D9E95B1-606C-11EF-8F8D-F6F033B50202} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430482135"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
624	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
624	iexplore.exe
624	iexplore.exe
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE
2500	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 2500	624	iexplore.exe	31
PID 624 wrote to memory of 2500	624	iexplore.exe	31
PID 624 wrote to memory of 2500	624	iexplore.exe	31
PID 624 wrote to memory of 2500	624	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b72ebe25bb4cefc7ba438899aac063e1_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:624
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:624 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_147AB4536A182B9FCE88E194D59F3B22

Filesize
471B

MD5
e19df013daf63239c1cdb59c121e157d

SHA1
a5591aea4bb3e1c2e3a9b01a285bfd887d5ec8b2

SHA256
cd5007ce6028f9719842b17389cc06a5082f2c75e0ca56caf95a348ae5b31bc2

SHA512
f41edae4751b68ed8b2a0519f930020cd1fe3a261071e5bd473817417a48ecbab6890d5dbfd44089fe1ced449b384ff1d59a43ca4fb74cd69535172939410e17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ececdecf803900cddcf56397a71398fd

SHA1
7182f2257ced977d1e86cd99a749980f58d4b402

SHA256
bdb1e559a339daa9217ca137c59cb704d479b2966ea1a3a3a43b377cd4755092

SHA512
6d5da2a36cf9818abd9b3b14676bad34a319238044c5373e4cf70719d6071db186288347e279f4098b27178e09d3248610c5afae23a58200229e46a02dc88450

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b2f125ffaf205c04b437fb10752fe69c

SHA1
340c37b4babd57abc3260d655740b03d60d39fa1

SHA256
7210ac48c9154853b29921c69c7903db781944082110f2ddea0a52454a611a3e

SHA512
86ef4afe7d72a0d96d1faba5dc034d2dcea995474203bafda250ac4d6243c03abccd14ea8abe75d9fc6a47020ea29ab32ff14b59474b2bd447b763b4d5f9ccd3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f144ca98c213d9fad1f659dce7b6b4b5

SHA1
8a197ef78a919fa9815f9fdbff9764d67a0e729b

SHA256
5cdedbbf4d191026dfb28a198e436abdcc7bc1161068e73ead46b23075bd01f6

SHA512
d0b1d3c6a3325d3305a299d2f6f30e0d4635f9843731be75381328abc3fe2f12290507f1893feaaaf2ffe669e4fb95cb8fb9bed6cf87402e0134df02a4271b12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
476569e834553ea530b72769b6ca81fc

SHA1
8cf162cebed83290328ab7a43fd7306792050b8b

SHA256
89ec0c050d1380cf61e2bc67ea9e28591998742d380ddba6ab3f3843b3519c42

SHA512
b24a06b337167a78150b5b3eb76ca22655b95a84f344887feed91fcc07bf99b82753173b27b4847b224ffb64cb416d71cfa6e9e232277a9e188b98dcf4632b7f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6da1c98fcbed4113065503fa51eba834

SHA1
bfbc2ef8f2da577fd76701e0a6e2475ac4f9217a

SHA256
5dcc41b79a2b79bdcff9355c2161b7202f7f2604c6c745b6e8f6fa9d212ca881

SHA512
ece00d7b7d7925199451aa0c01b3aefdc68d327e9c3c1f863981afdb96a2c65e4aed9232acfcdf7a2b52a12b84201ac3d63454e57f8c240ac6571dfd0e740cae

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
da3b75d7b97b147f30400130fb49cb1d

SHA1
ad54401329349dc42f102aef64b332964186901c

SHA256
48d51942e948bd3e636036fd142f428337bcb9c5b2ab761cda17a4a9ef46a2b6

SHA512
e97d8e68a3500df58ba05e63e3b6b6adcc1cf727b79d8addcabd82b1a22d07a28615541bbe649c926057d278671e6b4a187545d022d5da4c613242f8160534ff

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dad69f1040c509ecc23894629f35fbcc

SHA1
078164a72bb6e82b2380c54ce86e55bcdb0001cb

SHA256
ece9ff03079de9a6abd1c046aa1a553bb52f9fd093667db604d0cd59df9195a6

SHA512
3fe2fc40abad46470b9e3218783fdc715020151f70fc19706c567e18d8d6397cde075fddf9b89ace8ba644985e6d191a2a0ef021e369afe5fc69b4a8cb668745

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6a32520cbb445d091bc176a5cce3e61d

SHA1
a86d60fc76538a3fc85a18374bd9b788e8cc832d

SHA256
e942c39e8ba5ab06e4811fa6d39d307568fde9768dad8dd0b1e1e48366be013b

SHA512
7e4cbe8e99b7f6f8c02ec49ab66e47c0756f9cd3b313b80b149a3593e92871e3abad074a6e50374d5b3428205f6a23dd9af2a7b294655e81a17693a2221f6ef9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51f6c525a3d78714d660db881c7a312c

SHA1
ddce34541f5d762bf673ab0f60f485b01290a0d8

SHA256
6880b087b499e2c7566ca8f5c9d625c16c8b13afdeee10c6d08f3e70dc9b85a3

SHA512
898c10923b4fda9e3f81d03e87606ac870298c414afcfa8615cdaa58a3dec33a2d6e2225babc854462694a4d709b0d01b3fd4b24ad9df63c388124d5380bf7de

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ef491ee42936c7d4f03b25a692847224

SHA1
94861768876c91b2858d68a5c1503beccd49b29d

SHA256
13fc35ac717db72f972efa185c2eea3314a8835292013c0ada0f0268ceac55e3

SHA512
36df723ffdfdcaa108296d65d67aa52fce0a763f5d58702b59ca4d5e4e870e643f183fe78c885e7789a6fd3cfe865c1915e1d7925174eb5eaff8cf52138297d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q98GZSGI\cb=gapi[1].js

Filesize
135KB

MD5
cb98a2420cd89f7b7b25807f75543061

SHA1
b9bc2a7430debbe52bce03aa3c7916bedfd12e44

SHA256
bea369fc5bdd5b9b473441583c46b9939232bf1f98c1cedf6bc2241c4f5068d4

SHA512
49ccede4596d1e5640a9c8e8be333f9c18812d58f02b2b15adb54172df1387439e9dc5afc4ccd9d8f0f75f092318bed68d3cd577338e88ef4f9373de8a07c44e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Q98GZSGI\platform_gapi.iframes.style.common[1].js

Filesize
55KB

MD5
aada98a5b22ec7188655c2c17a083c57

SHA1
7c3c2fb8744e7412d8097e28f588788d91b9cd9b

SHA256
f2f09baa213dd3dd95edb5a30c7764e4a44d9a79c0831f90b1ad8ebedec9dab8

SHA512
a780aa3b9e36f61be8240487e75c19a96fe26d54abf9006680a00af9d1d394e81e517f0bbbc13edff3a7190679260ecd56fd5cdd7c2d2f416ab8982c3277b953

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab628D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar628C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit