37f8bcf52e45a58468bda4d725d95fa3e2c0330d86ed1a775bd5b32aa9df2fee

Analysis

max time kernel
140s
max time network
141s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22-08-2024 14:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7fd5e5113cd996d642a562c5773eda0_JaffaCakes118.html
Size

36KB
MD5

b7fd5e5113cd996d642a562c5773eda0
SHA1

844e3c091dba382183eeecd435cac7424875ebf8
SHA256

37f8bcf52e45a58468bda4d725d95fa3e2c0330d86ed1a775bd5b32aa9df2fee
SHA512

179de129d83966d22c0502999f5e58c0da0e903a4435177a92188831171327941700565773d558056344db945627399eccaacedba18326a51ff9e25f0fa8f33b
SSDEEP

768:Fl1X2tiEq21/tIxvXatXSjQbKD/my/XwGhuWyd:otiEXFnFs/myfFIR

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c70000000002000000000010660000000100002000000010b79ea14cc5b6fbc46d58536bfddd93d4a9ee5af2f78136e19556a9cdafe897000000000e8000000002000020000000c2a30ac9af0933d704e850350f9f3d184b13106508ad94ae92434dd6317299682000000028c7aaf87ff3c4cacaac965e7cab5a5feb99d90ce9717b3e787feb5f188c297c400000002b31a62722a9c01a26df8adc6ae41ab3795e1da84a30cb9c43f988ac7715dc3eb09cc8a6a7e78b0f57ed8bb4047220e77fa9f49d6e5a2b73ddc0d2cad1367e31	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430498713"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 708b0f9d9ff4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A6DC6C91-6092-11EF-95E0-F67F0CB12BFA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000043174f1aa2314a47aa677ebd5ad1f6c70000000002000000000010660000000100002000000080909997ea915229f8e538ddc347f72053a652edc77ad848d73435f9182f4458000000000e800000000200002000000083cc1d31dc27a397c42cc18375c9578fc5f2e295ef5f5c1fe35847fd771e04259000000001495784c3d8bb48d6cd24576f762f1cf51f9560cb06928a40fcc2e40b804f7403e8bd39cf0294e32d2694d018e4d410b5dc93eca394bb267f78991e20c8de5e07e7304b9137474feff6c18a3a3c64f18805fa0246e152732cc8065ffaa8235b2d3fc6984a7ecb1c751e4ebc8139c0c2fedaaea0f5c1c831e8a8992a653152426916ba71d56a14d91d1322b83d61ac6f40000000f7bada6eb162dc1cce2a2aa8eea97ea2f7b072b0946fe2a6c8efbc23c35f8c5c4e6c0e76a163c3790cdae795b9c07cf6870af2324c4948e3d6d8f5bd004e1df5	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2572	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2572	iexplore.exe
2572	iexplore.exe
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE
2140	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 2140	2572	iexplore.exe	30
PID 2572 wrote to memory of 2140	2572	iexplore.exe	30
PID 2572 wrote to memory of 2140	2572	iexplore.exe	30
PID 2572 wrote to memory of 2140	2572	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b7fd5e5113cd996d642a562c5773eda0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2572 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0099752581c88017001c0ffada902b3a

SHA1
36910d9d9f5cdff9f13dba62338d41c562efad94

SHA256
57ac134b2847dbef645eb011971a37b3bb1fdb03e4f4ef2c063a668f17beac68

SHA512
0dc9d15f9bacdabe5ca827717c9786d099284dc0f922d49bebc030f174cfdbe49a9a52601ac172020fec774bd1462c1ff569f687deadd0e7e1516a1eadfd07f7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00dd25bd582028846585dc9d9070131c

SHA1
a440dc914b17100647369b8e753a84a861eec7f8

SHA256
164dfc56e48b6a63de2950c854d83e6a4e5fa559e80d2ef1740233da99dc53ab

SHA512
eee64abefa593802db0ff591c3757d1a63a30b664771ca07c72dd890d66c68471f963a0b7ae32a6384132aabd65476b9000d89d5a8413d656a87387a37b9f881

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
468c40419238892d15864cfc889e463f

SHA1
22a5b63bce0390029323f2539dd54e5f2cbd499f

SHA256
9d0acdcd7ca1698b842b13da0d5ec8ab174386ec82fad02dde751da02409596e

SHA512
6dcd29c8f598e63be784e7905cd68f000c1bf101797139d27ba8ec96698c58a83cf0c1d4d2a72ddc921ac145d412abaa4d88480a83215eb5d55a0733bf596930

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
95bf070406e8ca4c69a64e69aa0daaa6

SHA1
c2b9575d50b370ad0c0d2932ac78ad000c38c925

SHA256
0256bf1da814a94d1ae98e70750e13da24d4e067ebbb6cd49eb757326cbd438f

SHA512
68200cca3b959d877014b6b48bdcc878a1a865b675e928585c6e3a7695e2445e55b8454e4276164e71f2c63b3b407b13af51405fe7254c134bb0ec01ed44a92b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4b286c113a0c88b07754a72755b49e1

SHA1
ffb00fb1c9bfc40bb928cce0602c5d7a61c9d755

SHA256
a7db3bebe6dcf1af08abf509aa66a635e68b4c7a81ec6971444a6ef4d644f22e

SHA512
77ca3914e74e389e2f6d135dd47fe85b6df37dbb15656af643df8fe8c03f966688fadea6805d674e91aa4114ea4310a53f1329dc2b73af88a52ab85a29366617

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf4dbd2af85acba86dbff15f22420ce0

SHA1
2b8c943fa34b9266b648e7268e8dc7a5a3547386

SHA256
f32ebd207426510de00ee59107fdc907702425b84393a536f12ef03b8c189922

SHA512
c6e93460c6368fd593e925ad6a96015b6337e775fa6845d470004bc0f65098e80fe637ee9a5eed010260c1f73296bf368a21d1fb770eb898a9df64597913001a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15306b70ecc49945c9287947e5c03e05

SHA1
01b9269fa4e23be15571add7bd71586e9d0e4173

SHA256
f69ffaf1bb4b958b06919bcd528dab83aa1a7c7a62b029cdbf8bd118d0e12527

SHA512
4633bbe837ff5668e6cb7f368566ac54fd13e96853e5c085076871b522c8c58f25bb09bf918f763b08443620dcb51e3226e2497e9eba44ec4f8d1d10dbcd8f6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8ce8f3cbafd0827c6f5732f93f8b123d

SHA1
cab3f03678ab6abcfc88bae547adbede14c412ad

SHA256
d4e637373d8302a99cb2b8c73120eaf7526240efcf50a6dfe9e6a8cf4ad809de

SHA512
28a523b7d4d2c33b1fe376eaa9f7d92c4b9516341b93d7aaae42f90dee7d1ff2b772e8807b3bb2cc77be1a112bc52b9fc1de3e9d8879f52700a4bc4954d10aca

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ead1d21a4860170577ae65661cbb849a

SHA1
12dd64a9db61ac6c7061c0d0c86607389a39ae2d

SHA256
d599ab25ca72d330b010076e3d7263263145ca36d22c824a8f497d6d83e15177

SHA512
ec00efff4480f353ca2d88f72128b7bc73be7301f7296f1740347902b67883ed2a126e75ceeae15754e7c17b65a2112b8c1206728415e5ed66c14bef7fd6633f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c4c6b5a541335875b3947f1768c665f4

SHA1
f6f4bb2bf2cc95901cc94e11a77bbb71dca3a47d

SHA256
e4a7d175f3f59998ffce77ed3d28c1b0fe213135a60d5e22430e69e0845863cd

SHA512
fc2aece7161ad42fd1dbd21bff6c2d0bdc5e7ba595f6338f5de7ae145930838e1a3f9e4ae51220e97a9479ae6820cf70efac9b0e535708c68c2b2afe43510c82

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2c2dd351ec120a5234099debc6f6266b

SHA1
c2b55533384e68320812bd79edc6783f33217b23

SHA256
dd2875b38734f155052e94f6eb9b344e2e97f15a39c81aa9a849bb3a89b481b4

SHA512
a8593929b656043833ad1f9533db9e873e389fb9d8bb08bb260baa996729678f8f01d6c100905a2c3d893ef1777555c67cbddcdcdfbb239cf620f910bdf25ba9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5bcf29d3de706a88855f10424c269039

SHA1
3f094b387076ec59f03d1b35704dd421b3532f23

SHA256
b8a86f415da13df892997c4ebfdfdea0d729ed1b0fc9c1376e702dca6920c243

SHA512
33e2d293395aed84ead22adacf42f170cc89ad2b765b6ffcb10167a1403b9514c5f3e7aaf0a21090fa4afef5f3ac4a3bafe1f2212ced26323cd89a28a38da9af

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86104695d9c44d63fa413627421ed8c2

SHA1
8fbf96a4733b676d71d2dd962120615c5e6c9502

SHA256
b6103a9b9339606a9fad799e1a8bd9968efafe44ec951391762722470ddbf801

SHA512
b52253915b1e7f8bb3710a0a537f4340d57dec45c3025627d20f26f92d544f521fe3165bf2e79a872a2145c659c75dd38a25c1f202310ed8ee3eb195ecf3acef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4cd9a868e9a364f8636495aefc2e2c2e

SHA1
1023872ff117999d8d8fff5909cea09c582b8aba

SHA256
4e2d1bb3e93a403088a006b6b0e4daefbaa53a1b62d4a9333127fb6fdb801a82

SHA512
d866f7d10ff7236dd0aef7d34e29824c820c37ea46169cbaef812dd6f802d31f89f17394f12165ca5bfe5ce27e58b039c39875561c80ec3709e5394e719ea02d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
160335162bcf766df551572fe041a6f0

SHA1
78ac2a6f3edd06c9b1365d7ec80a2ab1ae0d035b

SHA256
409e7dc1e7fbc09df646b5f440eb47591b4db3673d15e5d35013f2059ad0dd6d

SHA512
85c4ab3943c23a98ff65f3418f32cea6001fe7b9cc4d9923287d5203077c806e096aecb4df69dad6167bf71aff907b2cf5e05ab7b5ddb51defea561673f0ab47

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab8E9C.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8F1C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit