ef0bb5ad3cdf7d959bef069455e8a236f914fae481725ae99c71af5f7e49586c

Analysis

max time kernel
143s
max time network
144s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 12:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7a416f75db41354b0ace4ffef48b123_JaffaCakes118.html
Size

11KB
MD5

b7a416f75db41354b0ace4ffef48b123
SHA1

e57f10f218eaf4ebfb1732fd093166ab7316dc2f
SHA256

ef0bb5ad3cdf7d959bef069455e8a236f914fae481725ae99c71af5f7e49586c
SHA512

8ef887a83eb2f3db6fb90da0b09773c7f42e6e9ff6c518849bb7f35b7ccbd2c053834e3fdaeb5bf91ec3c3a4b3b4fc1d8bcbcfd3920b2fa93f16e6dbe03b1460
SSDEEP

192:SIHpsaVBRdKaBAVNvG6KpWs9lPv9NfVK4Xb5a6H88qm/HpsBw1:SIJsaVBRdKkA/vIWs97K4XfH8e/gw1

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c70000000002000000000010660000000100002000000095bc30d40841f11242432d4fdb6e8a34d5e73da0d7dff3d8466738732dd38598000000000e8000000002000020000000064ee8a8b05d9fe09b89173cce51e09190d64696779024af9e8e6db792b73b4290000000ebc05e770486a1bfa0da0d650c2686122ca6e1f68f079bca4b47209a015aa449b334c84b4d15c64034453b7e802868314806c84d57f798b1591f2ba8d8f0fd6c2bf389db2b482df1965dc1de59f0174629631d47d59189957875845b34090629124fc3f34cd986acf806b61b5e0735df02426c4d8e65c9bf9c4db666f782dbaadfdbee0f071782b5b35df193fead6e3840000000dbf564c1aad370c43e67ad55780af4b6e7ca8c86c61501a088a591c3157e0202e209e320b595563779e10ddfeff3e6ce21f8ca06628265b54e3e82782afaf7aa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90c76b098ff4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{2F9E4051-6082-11EF-AAA3-7AF2B84EB3D8} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c700000000020000000000106600000001000020000000ad00c3f8df44553f0ffcf4beb6b50181e969126b191f30a0c72817924faeac52000000000e800000000200002000000090788a3a1015be2008586373987a53c8985c2020ead5641f21677c84bdf14e1d200000008649ccd270d872373b082ae22b168097beed316bfa4059e411d735d81fbcd81e40000000d88cd489c0938e9fac1acc59654503c4d34308b13fa4a0a0655465de7a3187b10e914bd88eb171a950ee99f70a871b1c79fcb268b489838426b1c21c7dd9c5f0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430491644"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1828	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1828	iexplore.exe
1828	iexplore.exe
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE
2676	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 2676	1828	iexplore.exe	30
PID 1828 wrote to memory of 2676	1828	iexplore.exe	30
PID 1828 wrote to memory of 2676	1828	iexplore.exe	30
PID 1828 wrote to memory of 2676	1828	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b7a416f75db41354b0ace4ffef48b123_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1828 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
453b76ce6c4541995287a57d4fce0002

SHA1
6de6f43355ed0e82253d04eac5e575953d627909

SHA256
74fbaedb630c31669b04bb32921f12fb5ff32d8e2bb0b0df220fed9b15559294

SHA512
d9370e1a1079a14cb2816d30a75f0b90297114466d260697eefbc841d96a8b32511ed768b6673ff344496088d4346d6c6231051a4df46bf5c6207fb8f78f9a37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2b923cf3290821f7895e392c24840906

SHA1
4384910790eb705650f9c16d52a29037f332cd12

SHA256
6311ac2d9e43d217c5eeb3aac4167d775cf3343f5b0040a1763b8df6cc2ab8fe

SHA512
09f818bd9ae122f367f2437e7c5e0b033c8daafb5bbfbabf1c8ed5579a148442b024edb3c56f11166ae78fa9bfca37f812c6f698b64710aae04a9f9bf21ab52d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
847c23d1653a1f23980a2b8e962f033c

SHA1
7b1d8ac76a4531c5a9540a166cbb8d0b038b44df

SHA256
9d67535e88ebdf55d121da9899e519359b3e78b7d6f0ea6c973821dcd5d42d7f

SHA512
fb59ab274ae3af8070112307a13435b8f7dbc63022fe63b6c59dd64cad8e63eab634c672b2e01a0d3d9a58124291efa6474eee682a6cc5ac2bcedc599402754f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
23d2aeab6326e4f53d284093981444b4

SHA1
47b826b2fa206303e263fb2c18db2fa4094ba1fb

SHA256
62314e88d186df70c1b47b34a9f32e117d2b0908c637de82ae7870fddc94fc6e

SHA512
6f2a75e0162821822ae62dfe9a59b28d4bf23e794ed572b00859677b2062cf413ab43477c25d7c8f748d25cd8e6b3fbecc772a9af78825d97ccb0940a740e475

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03c9b542d2c5d6b10344ddf39a92f48e

SHA1
1b07c40fed6eafb5b3dc1617f7631c1c9fe95465

SHA256
7f8958cc0435a777a786ae2c0ce6b71508131dc6235e591bae1fdfcc38ba0a39

SHA512
b17722f0e5e26909884471b9c33dcc225a9ba18ef9d5d502ede190eebb9d213d51a0947b72ab6362dc9485180f2ffa041046de5a49551b46f7e232c38e9623ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a653a9aab9c54bb6d6bfd42616031a1f

SHA1
d82a83008b7b83676ae6203942e9c4da57988a2b

SHA256
5f1ef43d435835fb109337c963caff75f69aa4306534e814a3f975b5d5a392bc

SHA512
6ec0cf2efacba1e3f7ad54c8e7cc20a77d01483cb90fddaa3424900efad8d6898ab17a9b05de7d0e3c7c73b3d582437fba61cfea141c5d2f4188a156e361bbc1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b10e25a09bb599d7625362bd253741f6

SHA1
2ad56a29f566771ef28d6615cf2ece65509f6f47

SHA256
07bed8245f7d7e2a322b6a9e2bd80a855b7faf53d3ddcb3b7dc6e1adf04a0c35

SHA512
4d05ca0b2251d42cbc8744db73533c282fc72fbdb33a9b845c76b4a930a0f32a1f70c602d19f991f92dd0260be79a06c2be39511cedb5833cdd9fe16678ccad7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4f1cbf6c55c677cda81806fab0c11003

SHA1
0af01df5a2b6315a2b8f92179e04c22680d8deb5

SHA256
d93c7f51a73de71f14031b2aac42d9ca7c67aa78963863635f12d302fe69fe87

SHA512
50b057126a01ad08947e43692c5eda11a1b791d8818536e872cc208fdb6c32f5ea2172041c40bb7fb561d248041d093cf28a4fb03cbf995d82ee2c83cd99571a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
118e0bf70d81c40ee231fa29585b321d

SHA1
d06f17e720ca6715bbd1587ebe8237a076d5a1c5

SHA256
b78425becdbf2dfd7b7062137fb24d7e7f154b70cfbec9f3ce624629007caaea

SHA512
0c59d760e0750df00d81e117557eab91a6c03956b85f52acd4b6c15724f821555c074e7054b7423fbcb35f4a541e1e91d7c303f1c4fbe03669d1b558bb55d772

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4283ae32693f9c15fdae121d5ab8409

SHA1
bb86f6871fc4ae38e1be92191eb0deadb93e16bd

SHA256
31a522e0365b615f6b20b5ac17ed9ae4997241745162eae3444f690faf932f26

SHA512
37fbf58a689424471540151d154c2db034ec24c84d1c06d1ef056aace76f4dee8902346da1fb1679a6550a30f04563a390202a0274092f11b14a67dcf9cb05f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8d554a77cfbe2376fada831bb7c405f1

SHA1
d0f377d6a44f114da77e5055b2b880c6c2ef7db7

SHA256
f3d6c05c20158777612f4fbba94264b8ffa7857f1263564050519d9737abe643

SHA512
f921dd168480cd84b88ace667919ba3f0a238e6b7a4bc498fb87bc7dde23d9fc20a3f97c3f9a5e9ff502ccf43f871dddda1f0f7022e71e11461da45b097dd1d9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
ece96acd034879bc0212d41e09cdbb7f

SHA1
3c61086febd37792db9796fbf4c0d68548f5b4d6

SHA256
9ac70ebacc30448dd6125b924fea6d3822d4c8c8233f4fa6d010808f5aea2511

SHA512
647d8aac8d1f6dd55e00dc08734a09b817b91c7d4e8f16e9868bd454a8373e72bde1fd7b565cdadfc7bed97ecc732ea98e96d581fa9ab8f1e1c2a483584356ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
373f6e3a73088d8689687072bca2282f

SHA1
aca828cd46568b2666b0b100be2c6b4138ddec67

SHA256
2d6fa49dcbd7e049d2062c3ae48ef9f87fc8111559439f4b66f54471bb8d821c

SHA512
28a3331faa607f21e997b6aa5c6bd6f39877eeec97912f8120e0eae093231c3ea7e8fd7ceee6b70cf3d7f7daff8d95302e4bcaed4d7b98d35d774789e8388149

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD05B.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF8E3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit