a57c8ef8014578ab5bf46b634023acfa3efa8a5e4f86af6411260600e0294524

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22-08-2024 17:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b86f2097a5895cb0def77d9fc958994d_JaffaCakes118.html
Size

2KB
MD5

b86f2097a5895cb0def77d9fc958994d
SHA1

3704db9a973861e4dd16a43a12a1c7d62cb1e81e
SHA256

a57c8ef8014578ab5bf46b634023acfa3efa8a5e4f86af6411260600e0294524
SHA512

71645bed6c8125eeb875000cf1a9f81674f4327fea605986e94c6f38aef4b7a63a66568215c126fa92c63e226a625df9b6d85449b4843158a197a1d3b9419a9e

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d990900000000020000000000106600000001000020000000eb2d3e9cfa98f612488043bec5491f361ba6edbef5bfd39109a0fc791aa48c1e000000000e80000000020000200000006eff6d654811a4bc4233298c69cc5530f77434e24cdb3c21259e9461280a4b88200000007dea72468d2bf06bd1d159da2afa370304fb4ee0b059d5173ac9081be31d611e40000000548554b590b93662e9a97a3bed701d548425bfa87fe7c8f6252e05538b95df99a55c8a33c642a3c2113fd6ac2e1027f2d680f89c3cd9c24187d99753d46b15b6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{3B557AE1-60A9-11EF-A5A7-6AF53BBB81F8} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d99090000000002000000000010660000000100002000000014c6b05ad6532525e6d42c987496f87f50d8a4209d02791452f6f768cb7b4190000000000e8000000002000020000000d125949ba51c80282cbbd11c80c036809f8b7be078b629b3ed5a8872b693313c900000004405352493b75e626277074438b3bfbf1258f53cfd3b033b9b73d88de4883fe154c33fe09f380c56b2b9603bbeee55f9f8e40890afa81da88cbc484d8b13183a3cac51be176d31291ced5011327a084c4728ad4fccee6411cedfe53938ad2b068e5c2f1e834780a116364235baf71fc4ba6be06e80330650b191a62def3ed24151be8dadc04e373baf8a71d2a199291b40000000043c3b5a10ce9657c6f53828076ff5b0cf58b200d2fe25c26818e39b8d9a2443b8d32d160273576c2d705443e5a5f1390974ee945da322d2ae96d7fc8e353995	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 6044d30fb6f4da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430508410"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2416	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2416	iexplore.exe
2416	iexplore.exe
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE
2388	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2388	2416	iexplore.exe	31
PID 2416 wrote to memory of 2388	2416	iexplore.exe	31
PID 2416 wrote to memory of 2388	2416	iexplore.exe	31
PID 2416 wrote to memory of 2388	2416	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b86f2097a5895cb0def77d9fc958994d_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2416 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
57b4b6dc0ffeeaf2642d34dd675b0d2b

SHA1
63bf4b55af6a11ddcb55fc0b49b52bc9b2264ce8

SHA256
117d4b3a00f683d251d4c1cb1625049687b15e857ef4e138c78abd38600f58ba

SHA512
23c93882f4f5088de85bc9835b65889175e53dc0f7b5eb4bfa3d8821a03f40282c902294a17a1bf9e99aab9c803356e2874305beb33bf08d761a3248ecac2eac

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86dbc034972591cd6d29a247126aa078

SHA1
212dcd0790aa681ed15c5962133f477aa5d2b0bc

SHA256
29db4a83a7dca98f6ac814b9da1c3d9e949dfaf21c8b68ac6a424a47cf0932ef

SHA512
3f65f9b2ab3dd50f19247d699a72fac20272a4cd734ee78f5bebff01afff952a81761ccdb7ad8085bddc964a6a26da180d47584f95c2b593d09dbd3f28fad6c5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c2d875a05a6daff986def3c463aa8827

SHA1
af20d2c886b10663c8370562c796c16f9dc1669b

SHA256
eb5fcf282b97c2a3fd8c1e2d35f10bbdec31d999e9691df5f9d215d460a07a9e

SHA512
fcec10227b5dc2367e391c3202e156a04b1fe1735d675e8771d53564315c78fe504e60c06748e5b1bc31118ae0ef66ae96fae6b1fdf8487593c5ea95b82a376e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
829ee38530e341afbe902af1f068a331

SHA1
a3493258a8d4ba8b1dd2c87b22b7ce7bbe924d83

SHA256
c8e70565820ca268a08ab206f11474156d1baced0287142fb826f61f1d74abc2

SHA512
bcb29e69be52397090aa4a1e38f3fa094227c54955681e6aec54a603e94d58d8190792c652c24d356b2daa059997ecc984f2c6a2991e2f9c9c3cb48861e31a70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5384e1a0eaad09fc654cc1879b63d308

SHA1
5f6fe064e5b16f994af3e98cbf11e394949d23c7

SHA256
f4a613443fabeec2822f072e10558e572638abca8c1c88319fc7404e842406a1

SHA512
2788ef1d399db224554346ea6d252497b4c7f7fe42f783ca644c2b288e79fcd860dd03a24e8fedb8c842d2a78517ecc8b3122105709dc0c8c22b15068e95ffb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d14b7ada9480413b0d96c4c44d51c0e

SHA1
9c401ed18c667a2fab332b97c42b356deec3b141

SHA256
d47742378a5c9ca8632deee897af8ada1514f90079310b9300e960961d82e1aa

SHA512
f2310c48f5fd17cb53ec3fd7c265d526de516e46a5984a161a99726d7008e7a43a66529b69a17b9797edb583d0f84cc0ff7349b3607810bba790e5eb65ad4416

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d87da5b2e1a9f3123479d9855f2ade1d

SHA1
012f2c72a0f44577cc2a377f029fa41d5b24f7d3

SHA256
1f84accec55287418c1f5ceae53310ad3c00e0c3b47fea4a04ab3cab0385b522

SHA512
5531238b131b13f72b6b4717f8df29128db02b63d8166ea0e3577f97629acf686d845b94824f0ae436424455068bf280f31a429c3bfc0e73ffce363e551b8ab3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b825704b8caf3133625f8fbfd94dcc5

SHA1
67c115e5cd01de51891bb70dd51b8474e1e3aba6

SHA256
e461962af75631d5c57bdc93d798d171b63838bbcd6bfcc5373f962377d939c4

SHA512
68baccd852c56d188cae47e589bf8cd67b00fb143b20fad6b3ed7b84730fec8d53017a26eacb0b24d683932e9b7420451cdd6abaddf3e952a8a4389f0555a550

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9fe58108ec9dc0c14f519a549649e0ed

SHA1
a292b85123bc2e5f7b9f518041c83e17a2723d11

SHA256
e9733673122a16770a72e099cd887f2a1ff20e9a854bcad88a4f81ff4756591a

SHA512
8f7684fe65e4b88e0999ffb873057ecff1f0b0e630650eea090a8e7a68f7d24358179e6ccb785b2ac52731fa531a0acc685369ed7ec51aed6280c3bdaacbed29

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e7224b6ed09ad8dfe32cd360ffc0c5b9

SHA1
2d5f2b830ef214ae332845664ee49550f81a7b2e

SHA256
c11052261df9626163b63e8d37d0cce34e24d54853b4c52a61940af4799cc719

SHA512
50e617be04c5c924274a47b8d319416761fb11edaba0a3dc857e720883df6fe54d15edf7edfbc55104d17304a4b85852c15c66bf009ede2e1c1b5acfcdcda941

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a78d7eb64ac2ea42d3e4188d3b19cc9

SHA1
6389b4947d4500c0e27b55613345194e1cc4479f

SHA256
83bf4c77e75c7944e6cae5f5a083386bb19a8b11ff67a1c59a92273ea5c80200

SHA512
e8641476a1ae9520cf9e3c5e9da1025e3295fa447cfa279fa53d0f172e5de6b27479ea718d1807f7f9fda6ccd006dde4613fcd7858a84b145f19db1cd9fec528

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2bf72f4ed0259243a061bea915b48822

SHA1
287d8d195da34195001df871e63987c15488cb86

SHA256
e02d9b791735674308d68b1bff59a6ebf1fb2bcd03c9d7536012d20c487f7726

SHA512
1d9282f8a6a0c0e9e5beb72f3262b21980bdcf27ed7d24c834edec150c8826723694dcc5f2bd5e6d5e8fef0d1e52010ed5e25451cf536f61923e2ea0a4e1286f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
120758b07c552fed9f36dabe2f7ea84b

SHA1
d83c33329cea92e2e41b4f68cff8069b2f4fff7b

SHA256
4c9d03b8052c3827296f949d26936bb3f5bd58b7b0af09504e47755ccc987dd5

SHA512
3918ac28545be557ca007d6e6dac1f4a0cf23c793197f5ce5c11fe8f7335db367b29b3a0a7d11c2aba63daf73e02f094b408ce5f7d5f5e0c37d2eaf317eaf256

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e5c0cd3afb01b67e3e31289ff6b1766a

SHA1
9998453041fd4ea94f93760a38092f09f66bcd8e

SHA256
d20c5ffe0550843db820b06aeb17cba1a8b5d4c703666011fd3308241a25f839

SHA512
b61189647c7abea1935e41a226e7956808f19b293799f257c6efc9177d87879f053a9d1bd61d5f4b94c6c114db3a723c51d97e6f033e6831627a82cfd839c4c1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
380c2d6e09b733a8771ee3da422aa273

SHA1
cf7d9d5de3a39a3911b5e92c7be3c9308e17dc0c

SHA256
9fac3fa23923820daaa6a85006f2ccbafe5761626858de00ad0900891e774add

SHA512
b3c2853c634b9c009759704a7e7203b3ccdd0a2054fe49f413f0950c3a323554a70825f63019844a20670fc3290b6df807b3fa8d9f8a428ae93057a966447d9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
adaf726603cb1a8dbbb3d727cf3c9ff9

SHA1
e3ce978fda784dcb767a7cdcfce118e8250cb860

SHA256
d4b66bd1e614c11591899e809e0a9efbdfb3a086861709b1b09ed428b21465b5

SHA512
436025271f485ef1ac022ac788e9e188308f2c9165c4ed05dcb43b99b206de92e5244d51638d3bc56e4bbe9813a7be1a566cf3f1c4ead27efe2fc0680eef496e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fcf536fbcff7e788acdfd134158c5074

SHA1
316b9920c99bddb39f660f8b7dc87c840c58828b

SHA256
370e1df3eb7841eda0c489a6602c4cad326b55ec4a0975ff0cb5009d740eb508

SHA512
72e719cde6513b2505a68da1092cb6779cb53cb89abb21c40a0a625824c3634ab7abebee8b0a07f4affbac23b84853ad84ce71fb2a164495da7e7be320f52fdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF5D7.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF647.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit