91fb974678eaa636b764f7053dcdf63a3d46bac867af0f207516a1c2f13420a2

Analysis

max time kernel
119s
max time network
129s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b7a78673c988be7664d11492435398dd_JaffaCakes118.html
Size

7KB
MD5

b7a78673c988be7664d11492435398dd
SHA1

dffd809c8f1b408a2a3a1930b5a8ba61a63f9cc3
SHA256

91fb974678eaa636b764f7053dcdf63a3d46bac867af0f207516a1c2f13420a2
SHA512

82f27341979c1f3546e24f7102596309c66a92c9ff082181f8e9c6d3529b5ef1ec606f4a7df8db364b33aa7b009f5b000c937fda7398b41a907073e8c0905d1b
SSDEEP

96:uzVs+ux7wldLLY1k9o84d12ef7CSTU3zfCwdxCDdCCpdACcdScEZ7ru7f:csz7wldAYS/3OQZ/jZaSb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000ca36817af3b9c411c569fc2c8e15d973e6f8f0f815173869d52f4f2493c4a159000000000e8000000002000020000000cfa7cb33e3d3acf183f3ef6d24cf8e61a9fa653da76ef3528b2580289883b0e9200000001ede53998dfb203cda56305a7da357c972f466328881e758ff28924cd34259884000000011e425577a93cded9ae48c31a7e30036773fc10e2903df5b7e954befeb19c1332e5cb92ef68c86b504bb61d0c12c24d04205db2887ad0fb7ec613eddc8c9ef15	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430491899"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{C84235A1-6082-11EF-9257-F6C828CC4EA3} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0ca659f8ff4da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f03551000000000200000000001066000000010000200000004fdba8e6646140cb833bbbb8e9daa390b379b4d2d805fed350c17f1344f63811000000000e80000000020000200000004f62a4016d3530a5af17926432e1fa4dc03596c03e480d33a922858662394e4b90000000d82dc71e1289a2e941de1316ad9f39945065b446ec812bc62267657bd2edb8b19ea9a0ef5ec79fe7940d456416a83f202e6a3167e74dfbb4a370f1dd42228804675e29c745529702bd28a3c3dc88aed732b5b4254dfcf3a9c1f51c2eaa389bc2313871cfb3315b80ff9cc0819e6177bd843a6390cd47d9f074ec199ab5dfa76c84f18945571db118029366e6be04a386400000005fe38e7c2e784054de2aaacd9d197059fb83b965c9a17fa1314103d72d106a1e9b8c8a945e3aecbf7d54c94122321153757b5eeca6861cb20cd1fa36dc057279	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2144	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2144	iexplore.exe
2144	iexplore.exe
1564	IEXPLORE.EXE
1564	IEXPLORE.EXE
1564	IEXPLORE.EXE
1564	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 1564	2144	iexplore.exe	30
PID 2144 wrote to memory of 1564	2144	iexplore.exe	30
PID 2144 wrote to memory of 1564	2144	iexplore.exe	30
PID 2144 wrote to memory of 1564	2144	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b7a78673c988be7664d11492435398dd_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2144 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e4c99a74dd6f507cad8e220eaae6a05

SHA1
50b22a66d01f4fa72de3cc581266de0006a97679

SHA256
b98f116751b80b4c2cd0df0e236e69261664a56c8840cef3d6c1a977540708a4

SHA512
89f8055d595b8f408c018868a8bdbcae176423c573e444412fa199a2f9d2c55aa952e4d0a0f82a229642001991f0fbf59f6ac9a77287c4996191008cfa2b0201

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
14e6ad1cbac293642fd9f1a9656be458

SHA1
8d9d306f0c5b9e808dbbb9b03331d67502e78583

SHA256
2a6c02edca549286db11a364d227f726c9a7410bf52e0e7b0065d93b78d16bfe

SHA512
d085b74cc6d4855ca508b2306e484ac331a2776aac18d7b1fc00bf38e5d4676b5dd5e9df8bb4e5243955f2af35d98b10ee9c7d82d511659ff357459984d9a989

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7756f2c1fa0e9518326dbdefafb9dd5e

SHA1
7d0b432e440f3b30d82d846baac7d6bc28c457bc

SHA256
d75e5dbda8ff04e4224f74ec6cd1335adb83686d37c3dab43d6d00c8c5d9cd00

SHA512
9a1f44a007c7aa4870ec0e4356a3543026fd89d70d30b3d0ed85ea65eca021340a0dcf0bb423c40114da9ae2d310599da91024c399576b6b9595052c60d21228

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d6a838c4d0d371dc9c5ba1866adc71a2

SHA1
035c8bdca4e76b46dce7bb6c6b216c7a856b15f6

SHA256
673c199dd06ff92e32b13ec8f58f7f536141464977656159a4e74d0ed242e30e

SHA512
04302598f10f3c340cfeaefba7a88fa8ac434218254e41db62d6b5ea2ce173dd05993fb3706136613dd35a8533a9b56cb2210f0b10f11a9a0a4f114c59951779

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9e02454f433be81558f739b0f82f17fb

SHA1
b60cdd8472af0b82337cebd78a65d480f6ac2e88

SHA256
233b54c2271d75d21a7d90466d72be6538771f5faff69722835039568977964d

SHA512
7a842f2884105e1b6c3e0e68f831b5b2e89d5238038b1d28f8b9f72c7a8eb2a92ca23f5ade8c3986960705b94db96b129a70a25300c9a2da7edff4441673bac3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eaca313a124924f38570af5f048c8b33

SHA1
3f5e10ad70a80c3c754d40fac8a9ab1cb88ee47c

SHA256
9164912ef07b9a145d29fc8168ef44c71f54c8474d8f9ffb13c6b1966492b553

SHA512
1d4c9ad330f18e0fe29cbc695f4ecf709ff489459270586c799bdb18e4cc20ebbd6c140c77a075007674beea562dc765426b2f4134ceffb7fe7e4fde0326e996

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2f699e66fcfc08a7969b9beefc74562d

SHA1
f4a5a8ff002382d3af000f4462dfefd930c2beac

SHA256
6cf9cd9d5c1a4f6ab7fc63a9b4f38406c20a4598e3603ec8e2f2638db7c98cef

SHA512
39e360f05262a8b9b59a258c4fafdba572327b3e11cc380ed966991c5855b54614599256ffcd9d1ed5e5b41486778bb7f0113f5c12b81c62a389bcc301055bcd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f67f860857a17b14fbb569266b99e103

SHA1
eea9fedbeeefb75288bdd9122403f2e70ac79c0f

SHA256
4e79d71eca08dbf0e9b744989b1ea239463c6d0b4c4707a22073dc09acbd6833

SHA512
62ae9aa19b4ba2e06930bc83d810052a60d96d6cad3af46c281a7cc80ab95ade65a2bb4c65c2aaccb8e8edccc5dbc6a5fcc67f7e17adf157fa2fa5c0c6c3bf83

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e1b8eea9c17954740f083fc2e3f9619a

SHA1
93d0af784dd20ca91010bb7f781c055bbc00023f

SHA256
f53edcd5666713022a9be8b73c72c464f35e6439045e4c7cc504f79fc3fc3b62

SHA512
e50af2f7315ac655fec0c6a8ca0ea0160121bdb64d8ac8297e2f5f3b4de47e1b072da27db83c2aca12f3655ef16023649b5855e6b7c1a6ea1285e579c4f4d67b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e95bd820056faa8a3e32f4635c95521

SHA1
fecd2a086c2e355d866626df3a6aed8c6fa65aa4

SHA256
fb9cc66a78b458a5ec37b90a509b66aab3d35df94d73690faaf0ae6616663726

SHA512
9bf4d3662574cb1338642d84ac82d9a494575a9b222a471a9ff65a688f9399257ca0829297f657e49dfdcc3b34de896e9812817e6396fb6ce5a2bd0cd28dae90

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b8bd21bffbfe4c26f52954ed44395cb

SHA1
ed66cc6942c39d57dcc58731be9ce3574a737206

SHA256
677e6a5ff64aa59e5ac05d9e5c683aad43601c68af5f21d82c0fd95d9eef93be

SHA512
8ad377294c1255bc56074a98ba8a9cb70e4ad3881a3dad9f7ed1928cba57b1501c5c4539487f5f3e9a83d2e7831728e7b3919d4e919a691ddbe749036b17a180

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEDEB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEFB2.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit