a7ab5316f982e987c96bb48979407082a381fb560a6b46e694f6bcb3caffdd98

Analysis

max time kernel
72s
max time network
138s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22-08-2024 17:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b887e6490850a824553637edc36b2e5a_JaffaCakes118.html
Size

2KB
MD5

b887e6490850a824553637edc36b2e5a
SHA1

27e248b3e92b2958cbcf5675ab86d4ddf8143ffd
SHA256

a7ab5316f982e987c96bb48979407082a381fb560a6b46e694f6bcb3caffdd98
SHA512

8c7204946f68b4a54588505187f7112be1319e8d2879cb40ee500eb0fd6bf164fb061b318c9907e48c859884906a3c6e1f6daded7c656ab114b4db1f75df4c75

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430510388"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000001d407afaf5e8dba94b510bee6377c354668c4d2cc1c50b657a5e3af0103b6f12000000000e8000000002000020000000f869d449e5d1c27f31c5b4dceaffef25ce3f32338b546bd6c2cf049ebc9dc13590000000da8f7114c42ef7c847b4e4f8c41f01d1e1cf378232fa8d0f812970273ccc3f99c70f3bb4ce3541388934fd5dbf0c90217cd817aaa8e32cf8db0c288c412a84225090cda13efb01f2e64ad9f5f3f88799e0f1c9f72c299321c266a66a938e38bf660254121fcb03476bae3bc4ec9476ffab6ccb1204b3db9f41faf51a62c93b1dc6b531ca02c047e4271fef5229554d0540000000205b7975a9e8c34d13ab3cd0876d453433ca33fd07b75c169d74c190f2c7e776aae94cfaa0526732e6bf107826ceba5eaeecd8383b225d597a92e70317622417	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D288F371-60AD-11EF-960D-6A8D92A4B8D0} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b7000000000020000000000106600000001000020000000d61f920ddb11efb9a52878aa44e00aca4c02b6dc3344b241e1d6283c62fe1855000000000e80000000020000200000000f8f9e57688046627587c2f7e1aa32b970a6b1dec2a3f8ef6bfcccdb6e850a382000000093b6a0ddd9f21d53e07d9269fe4b3e0a4474b786fb22b7e4bd75e8d726d9ff4740000000398a46d0e50a4b5029837531b5e85b23fa3d19d47f3024cddecb256ed19c44824801318b5cf78f1fa5f4ca0174a5b6d53a51905fac3208dc321c318539706c72	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b00f71a7baf4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2796	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2796	iexplore.exe
2796	iexplore.exe
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE
2720	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 2720	2796	iexplore.exe	29
PID 2796 wrote to memory of 2720	2796	iexplore.exe	29
PID 2796 wrote to memory of 2720	2796	iexplore.exe	29
PID 2796 wrote to memory of 2720	2796	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b887e6490850a824553637edc36b2e5a_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2796 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dcb04443c01748f9c50bbbe4373d0347

SHA1
04695c6b3ce82b38146f376317706e716a131b8e

SHA256
aaa8a700c6939f4a65fd1dc63d2633ad4bdf77cfbba86a664910793173252ede

SHA512
6bdeef2307427ce50897d2f0d3379e7c82ccde711d87ba8292c056a8361f42bb127a551bb50bdda6aac6200dd2fee2e386fc053ec488558c94ba55750056f1be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3d0b702e2c049dcd9959692ad5ff0452

SHA1
bec1e0ec595372e78ef497cd9589a0e0ca3bb8b8

SHA256
03d2b0d5d79fb6568bed3a0c1b098ce8e7b218799879c347d9ebf0b25213a896

SHA512
f35e69ad960848059efc80937f086f6c8a06e42ac77b999d72f9a02fabebec3ae4ca1d80a0734ff0a480e3e378cc46ec5c7c073a68a5f66415126b400dc649ac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4179ea3da04cdc773d459ec73121a40e

SHA1
4ef1e3b1ef5ea1a38813a4140779bfe8e4b2330c

SHA256
6815989dabc043ecabfac440d3dc2b5ddefd33d7d1980e74ab21ca3df2df2a10

SHA512
ac70f5b53a3211fc5e38a809bd11a708858c7c871c436448a48625aa406ab6d3b0c3306192eba7c206fe01743ad2adba445d8e37427a961c809ca11b01786ce6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8407ed294fabb16bd43fd3e3a37e61b4

SHA1
5b1e80f060c6294a078779a732164e6470cc0519

SHA256
1da16c33c04fd6d8ecc49e1f6aa2e6e7907dbdba4e6f25ff775eb528350dc80e

SHA512
d549228254ad57ec51aa7d432c66d7f430b769473b7f3e8b5d76f10c249cda203dcd50a15f98d927680d6722a41af7c10ab4304d4afe9d3db755df76af042ae8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a661d661f9414b11c42dafc8a90156b2

SHA1
21899eba6a2e0270f76c17e36ac4c2d5190a0b67

SHA256
abd92f4de62162045b2bf603dfbb4d642a562e7284b1b9a9bde04466b5ca542e

SHA512
ee979d6a92c80bd42cb18f99af3ba8d0b85727fd6957e6c52f5f07131927309990edf6b1ef216e79177172aa8192e16f8f639c489a24cf5a362c79264bc33804

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39e0af756ae76bd39a0705774e2c1a63

SHA1
43caa9b4983653fafad2dbfeb40b40d680c75246

SHA256
6164a9acc22b6e9d8a8faae68a12fa3cf481c7f7deb55973f739ec98df6e0601

SHA512
658946018ef6c517d56c725f3b5a4de65b8cc84056040c5789f87859dafca1222c032d3098ea361ad377d881ad38ab60c398e6f2f6d260a17225cd6e2d518d86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f35c4e4abe5a9e3fa1f1f0a3a747b315

SHA1
bed43de53ef45c923a25d7bfc3a3861e7a62de84

SHA256
84a16280a500c622544c4365d35314fa57807b60fada6fa72f488b7ecc70487f

SHA512
55e56b5f9df79faba47815fdfee714ef5e2502a3ad14b051715f648b1c895627e35400cf4f892691465b9fd4020a98909332bed10ae885661ad4e4c95ab8118f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bab9ed9b5e4e47bd9d8dc995234ebde8

SHA1
c4a63765d26e57321131e3271e63e6a79cbef3e9

SHA256
1be94f9a79f5d802bb2ded49d954c3d383c54282850986d418be5dbf46bd7f2c

SHA512
31b72773b9378b93a317f230a2950395719aa0dfd1325f50a5d2fd2558ecd339f1a13e4bf21f1cedc7833cd480179fe2434ee25c8bd7e7f8c73f90397ebbfb2f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9bd772bc013f07df6999a17fb866cbd9

SHA1
bb50c3e5b6572dd72491a87923e94933c445f0ca

SHA256
3a5c543d0563745efc37404ed45df28e807d8bbd3790aa4cb0d988c68cf3d120

SHA512
0b5014770ca00c61a6c2a059d1eb939e6e5467e3e2938b24dda9ab7ad463d74e19c75836fe76d3ee4784eeb52e691d18445c43ab28d9706376b63962ab28de92

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49e75eb78a691c562c56c276b35a5d42

SHA1
378bec9b986539773b799054e2394809e784dc52

SHA256
57a773044c11512be5bc4b6600d57eca125dba3fe4ede274cfdfef8bfb732914

SHA512
733a89e4394e1f78383cfc38808dbed2dca5383e157c61e888dec08bb69cc715c0fd30313dc213c7e1e9641641d196f9387b9a24bbd8d2ef265a50092741d27c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
370ae92347821f8c9c264047b71ff467

SHA1
73153eb09343394ea0da487d8cf24c63c0f4a6b7

SHA256
5d0461656134e02e4ee1e962b1527c0ea6831c484b2f933057371282fb33a1b7

SHA512
813561e3b6964265594d07fd2ca0681bbd3f17267bcc89edd7c5b9deb243e836fe27898bdc338e0c6bf0ece4636b1f062e8a5078d826fd0c6b3f242a73ca7bb5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
12729339a1525888882a5da8bc572e2f

SHA1
dd8e9b31a42e05fb01c50665160502e5a5f9ad9d

SHA256
398bdd2297b855acb38e77003abcb8ae293efa661a1a05b1e9feba130a185e10

SHA512
30b701b0563c9f296de323b518681250f68c88389c4e0c6b92c79d955c9039369b61162b6c7e168f514688feceb89628666e7483d6c18e4fbf277f813a093c7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f811b5c1374e045de90285a30c47f036

SHA1
244bfa6425b7151fa1e005ec52f3c7f83f637b26

SHA256
aca918196a0f3fd61ecea0f3065dd96e0a841f8e2548ac0a4c5eeda0f6f154a7

SHA512
cb955a59572a19c611669edf4aa00a3e0f9036dd78f610a94db469871609d5119a745dfdbb8e969206a87e44d6cd692561d313385ddcb38af89d3366d50f0e11

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
66d3478159b46e4d0b9dc48d860b2621

SHA1
d7aad2f2b4a34a523a8fc5dd0b4e5b90f2c61759

SHA256
ba562d330a2d93ebdbdc80dc1e2075fd85f277121d244dbc19b22e897ca230a9

SHA512
4d4e313f704b68b89d8444e7c0cc4dbb42e78444d1306cecf2ba3b6fd29715aa8d46f7ce745dff30cb47196001c7a7129e7dcb1ffe2c907f9d41e0381d5bdb38

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f22455cf2e66a2866c18752e4491dd04

SHA1
3906a8f4c83878b5794651ea93ee2a4ff47dfc87

SHA256
9b298d18fc6ae5f44892445c4370e19c84704915b4b0285d3a103d973a7bd906

SHA512
3359aa2be2a1f2c01c1fece03c0116cd40e9d919617a1d112d984c4a9b4ab4e9bd7c3893d1aef802eae653013331ce3cbdcd69b733c0aea1cd2ef17b0c89ca32

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4ba763be4499e8fc868029fd3decde4c

SHA1
3ec4ab94f9f8b529a06737041b4528ce3ac5b63b

SHA256
0c05b20f624dc8bc8a55aab0e019b0889d08249f7676b2d8705cac6f3eeb0f62

SHA512
14791babc10f1fbd0dab937a6d677366556e7e7519f54288f3b6a948be51673cb0df79c5ce75698eb916e3731dce5eb88d0c487a5c68ba0efd821a85507cbdbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab27EE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar28BC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit