9631415347cc3a25553ee329c843d69e6e38e506f6b36aa1b1f3aadac8017312

Analysis

max time kernel
140s
max time network
155s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22-08-2024 17:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b870d08000a1f15044e143752a581a41_JaffaCakes118.html
Size

21KB
MD5

b870d08000a1f15044e143752a581a41
SHA1

ff37ac5cd01067161cb95f9789c5066403e2be44
SHA256

9631415347cc3a25553ee329c843d69e6e38e506f6b36aa1b1f3aadac8017312
SHA512

d042d8187de8e304ba0dc09f7a025a89e0761260ce92710281fc97793d9b150640a082512126a689892948ab86055f37bfd80f8c677097fd6c9d0a00dd78e34f
SSDEEP

384:4+QfPFd9QZBC7mOdMMy+KfpC5IgSnbmFe7AcGP6dY8E1jYsPd:Zcd9QZBC7mOdMMEpC5I9nC4c6sPd

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430508575"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b700000000002000000000010660000000100002000000062654767421c190488670e428d8e6dd1ae3aeddfd5be3cd272672374e669f559000000000e80000000020000200000006ce8c0b415933624254422da05405c6ae76ff9ae99c712893a2703a45a9e4dbe900000001adb43cdb2b6bc57384ea7468274beb8de375abc6bb9030f3bbbd85ab05651c82ff858caa949f9261081c8c501f374b2a4df97146981b7567e01a391de8a667124ff30871d5f40a3913790024d2361fc332a3ca310acb907b2efbf406a8e66c1196602e33c508d49276ec84b4e7a527cc3f5af4ee50db86d16e58a6e7d9274fee821f0063e29dbe292f4aff2cb2fe87840000000aada9d68e93c56a4579811dc67ff095e2d811656f5fbffafa9466f1656d156f69d65826b324c8966f5106e7de5b4988b895652b2fd2382d73522f4ebdcce3d7c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{9AD4D651-60A9-11EF-A251-667598992E52} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bb7c5835718279428690b074aa627b70000000000200000000001066000000010000200000005c60ab138ad0b10c93d965b6f204158a1faca80f33a9e9f18b3f482eeb4aa22c000000000e80000000020000200000002a08a09fd53f957a07f662b62942363aecb2a13357ffc192867c65a9549932f520000000ac5daa366c3bce8bc205dce5f9c1533a6ed90f5e8ee15bba8658ce5ff616581c400000006380a08cf92760fc2cbc9b84bd701554d65fc50a52eac26eebabb3b3be0b5f0dfa29702fce29cdfc8c1c90f92262e7dd33a9a65ebf9c49b9fd681ac46e212616	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0814b71b6f4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1512	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1512	iexplore.exe
1512	iexplore.exe
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE
2804	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 2804	1512	iexplore.exe	30
PID 1512 wrote to memory of 2804	1512	iexplore.exe	30
PID 1512 wrote to memory of 2804	1512	iexplore.exe	30
PID 1512 wrote to memory of 2804	1512	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b870d08000a1f15044e143752a581a41_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1512 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bed1fb5a9f6c6c79e412364948ce8216

SHA1
665c3c0b40f94437be06ac9fe66c343b1fd076c6

SHA256
5b2eb98d4dd9be40177f97b2a1f5880acffa3712fabf7d5de9ad1292a4f0c4f2

SHA512
90adf26f40b9cce7d809e20f5f18c96a977eacaa063d4ac2c69b2d9e5b0e0dfce00717265f7193d7b8d34f577229c77603c4831199ae289f7013001b8c79aedf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31968c7864e15dd580a3a091781717c0

SHA1
2a242fe2e0193bba60fd0f264318ff9c89353f87

SHA256
4e972e01448a72a3004e9996f67666fd03308fee8982d0232637669ee1eb95d7

SHA512
0654852e7d9b914a96470fb92d2cb4bacf485b5d304435b69b420f47fbedb75459117c662ccbf6dbc1725f1cd196c707f48f904bd7ff48a2f3e0355cf9f6f968

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0b07806a5cc0f3da0b36597fb47b02cc

SHA1
78ff7f4e2db5c7b6957d1dafe49d98239daa8166

SHA256
67d6e32f1dc172ee18aa59ee0bfeee9c34bfd66f09a16b649c20461f0cf89cdf

SHA512
e70df47270256437968e85d04ba9ec2cb0cb92a9b92654bc77e851121e36774c1346438f3c738a2b51d64d4a07eac91697564a556b11cc6980f42f011ff5860e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2bb2d2b1b504b2a8d69a8762776e88aa

SHA1
1a6dab8a2a749c3caddd4d5266be384f20b1cadc

SHA256
7151cfc275b5e82323f42e0a32bffff31ea288b6e00a1af372a88eeb2632433c

SHA512
01bd237ce572d63b38a365b92d622ba3b4dc7a48e442bbbf05ccb449a15cdbc28243caa1cdbf88b419c23bf872ed8443c62d789775b0bbbbc8a15eb0743491b5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
24106a3e1d03ba4d9c5a0476cfc41e12

SHA1
7abe3e64c0873b6793c29764fdc6c139928919b2

SHA256
4c0200aae76e3e2d1c82154a5876d5afa44436f77c875df4a8bf59ca242f01dc

SHA512
608f5808245f1b2f876641df98e90f594617509caee55ca668c410df90134d314489fc568cc5e34f0982132be9792337b1e1dc3cb15a05a24a0811e6ba0aeba8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
87b5c456c1d49ed8381f848e3411dab7

SHA1
2e264996d753c76995b538cd9c214bd97694b528

SHA256
5ec64ee4a1bd29646cb614f5677afbad75a21b925dce0cea3103abd03962e98e

SHA512
52896a8987fbda0e50e7a34f4a0829a1a451e7980ce0b7c6ca182429c65f1ff5b5e778e85c6b1d4d22361e21ca1f16f680a57b794cc5a74d446658892ce4db87

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
167c1897533ad1b65ed05e92353d99af

SHA1
28d6d692aa33bff71482c69e18b34839b0aec924

SHA256
a62cacc07d5c0dcf1a7c61de3a56c10a219e52c64e70354e669e3852b41190e6

SHA512
e009afaee29e687d2f611ee4dc408bf2eb4f3418ea8f9fd7285455050fb95b510c5f2cbba83e90eed094cb05ae8eb9b95ae7e718f77c6d540b2689441480a144

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d40ed4db0245769dd164af4900509a55

SHA1
542bf8fa0ddae19251d82e5ba9947c7dd4f74dab

SHA256
0446807f30f95e8ece5daa537bfd334e8b69629e893eb7de0b0b04bdd476b798

SHA512
33abc92fce741815c8a307b187d8fca5b88beab2e923ee39fb44a3df07107995c1150d19cdf63b1bdf4126a7e1686cf33a57d18bd007543f6acabd087696bd21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90d54a5918026bea5947cf118d1fd5da

SHA1
24ce990afce9840104f675e94744787a7090fd86

SHA256
e940a6efee50bc759309d77ba571ff3a77de4566e19e222dec89b5e22e9f250c

SHA512
4586dde1c75446b91cecdd16f04a71238793a6339abe2d26cb268f43885f099938f2c6756e342d9a6bc797f19931980ee55b77aba723697f1c2f93257e647cde

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5a5fad59a8464191fe95096cee40f6ba

SHA1
d432facf71ec10b2b1298e531b2490904bb69294

SHA256
e6df03a88263ba6d1c809f1c3716db9438fa14d9ed4e0a8290f1de8b765958c3

SHA512
7182b4cdf66213caf493b656e0c7e8bd3b6e136f24a63e79ceddd0334ae9d3a0ee1daea84b883c576a7f495e16268e19a20da1b3aa49af1ce42dceb944de1637

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ace3a400d5326f183cf93021af6cf800

SHA1
fdc3f6268ea879284108758e7c9e3d6822da139f

SHA256
17e891d100910d3350b8f648db35e33f38af74712247f84697741251a26b273f

SHA512
45ff14e0dedc635d8551d7701dbfaf922bc042787b6c5765d8e3844057257774a078443600de2a3e7c3a7bfe0da22fa8250d2c4dae2fb74e53693d569b093269

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4adfa32c9eb09bc3a8bf8aa4f33030f5

SHA1
8490a18f6f1b59b85b45e44cdb87f0c3bc3538b8

SHA256
021619a0152bd6deea9c298458c643df59f0c7ffff5aa9a336a42d3dfa65c0dd

SHA512
1b0474527403d61f8a1435b20cb6bd0c9bcdaa2f131973472f81b8deb4a0b97b7f40585fc253c2f734dcde9f2f27622963df6a6dbd17267470a0961005a9ed21

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3cc9addd04c7864c373525fc7d75d320

SHA1
29aba9acbaa5162ddec39daae48bffea38b4d411

SHA256
f33ade43426fe8d43a93e602c5d261b1dd129f4fc058191ffc7357a948354e39

SHA512
106c121a9ac012cc1b09b9cb3f7d0921fefcb0df4f5fb7e263dfb69a2492e48466a000ef010e3eef1c06f72c1d12103bb7c23c02822521ff6cbb385d07617801

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae7a36ffee5c38d6efc3cb9c1065ba85

SHA1
025174bdc9abdd8a80be1339a8b1ce1d1bb35d9b

SHA256
1a94958a9ecc5931d10ef3284233d82789148072466a157ed317d0273e726918

SHA512
15d1b54af3550dd1d2460a67eda192c60cff7fb96f7add8332aaa0f87474f5791b57d9af8d11ef6ad4512be90315342b88ad3a6d33b51330e417ee73767c467d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
39ff263eac878d1c67705ec9d08fc5e8

SHA1
d0e4d5dd740927f7f68e87a1bc7af3e8d0b99a92

SHA256
61d2e80f5e4f7fc1094d12e5c0a61a0ae5d179daf7ef40d9b3b638dbb8b70ad3

SHA512
f110a77e135456e902e8cad4b7746272352f7a8fe667d44e34ace0d327a08658a2257910d3844873937960bc5a19a6b1df44885bb84c77fa5567cd3f63b8bd82

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabDE60.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarDF4E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit