985aac4f0cf565fa1fef4f35ac16020fab5bb4ba2830088f2a909ca8f4e98e58

Analysis

max time kernel
122s
max time network
133s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 17:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b876e9d8ee738ec6f823a5f921ab3a30_JaffaCakes118.html
Size

6KB
MD5

b876e9d8ee738ec6f823a5f921ab3a30
SHA1

c65e6d615d69afc0cd1c800ea7fc2fb41234c961
SHA256

985aac4f0cf565fa1fef4f35ac16020fab5bb4ba2830088f2a909ca8f4e98e58
SHA512

84d050721f56b2c18a2d88fcf25781e54744b56c2f988a84ef9b2c32d04445ad1dc7011d92958a8a88aee4e7e67d6c985699433ec7e6826f77a0608104040bb8
SSDEEP

96:uzVs+ux7/zLLY1k9o84d12ef7CSTUO6cEZ7ru7f:csz7/zAYS/Cb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20be48cdb7f4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430509117"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d99090000000002000000000010660000000100002000000005046d4bd802394761c404718f703a1496f871da85e9535a46a10782986af47c000000000e8000000002000020000000cb9bf65bd83852a6ccdec030e5eac1789add30b872c7c55dd9aeea9dc2608f8f20000000ad8664aab2b3f01e6e5210553f1093da320100cc6da8ea9eadf4a9b239c0a46b40000000eca65f015a0935bc2ce297a420b1a51027b50ca0d92569c48993152a670302a1b50fa7008c37f570597e3c3591f1db75487a8421641097d889749f338ea05047	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000002f8e41e3384fa749ac47329e409d9909000000000200000000001066000000010000200000002077ead6eae8bd444ccdf8f29eb16732febe28fe5e652758211a0374a1664c2f000000000e8000000002000020000000f084c910484eed52a1940ed0532a8f647b93c465b310419bd851fcca6c43fc46900000006551ee81d067bc1908d38e12d8e1f99821f5cb9d7456c86145be023f82ce458ab8e60190bcfcece3f3373520482377094015be1d5554081f76520450551130334d2ff9a55ffb7bcfe6d04b23514fb593a1e3e770d9cda30617caba3221cb818c0326c5768890b5d89e1b33f94015ffc189b86b26b616e09a79e31822df02b229b2861cdc9a62b2d3154f78d900f0f4de40000000d915d3714711ebed0279346c2c447fbc53e0ded051cce874e440949bbebbaa702d733433489a9c2a6fbcfd55e5b231520d94cb65a6431526b0261b51a38d681c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{DF9F0C01-60AA-11EF-987A-EE88FE214989} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2692	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2692	iexplore.exe
2692	iexplore.exe
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE
2944	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2944	2692	iexplore.exe	30
PID 2692 wrote to memory of 2944	2692	iexplore.exe	30
PID 2692 wrote to memory of 2944	2692	iexplore.exe	30
PID 2692 wrote to memory of 2944	2692	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b876e9d8ee738ec6f823a5f921ab3a30_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2692 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5601372beaa6c584a0a42d66d5120180

SHA1
31e21dcebc11de3b8cde4d1bf1f93f83cff01ce5

SHA256
a2d03968393422f93b64857207be9ea8b559bc04b7b5e7de532de8faed90630b

SHA512
93797466c972a7f2f566a004841527fb784ab27f9d36f9b5c40b5cbcc46f55c2b36256d7b2eeeb398879f42c6a42f047f4e79d347056910f945f1675396f476c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4595cc6f190cea8e520a1bf954083fbd

SHA1
76869e0b31be46e6a18eaefe77b9ba49b4c92a86

SHA256
98c411130732848c2c847fd8be899612111e9a8a48402ffc6d51504afa5e8b5f

SHA512
46b69e2ae63567cf5648e9820f0e5e5b7b93551a604a449a3856f8a9c6a5e4edf6246e33a5c31d3ef782e477d84181b8c26c735e124b08049242549a088b17c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3327d3e50fca51b4c054fe611e3aac63

SHA1
682d9a97b8dbadce4d89153f2ce4ffb32a9d42ad

SHA256
d563a9ec57db7565cb1fa82bcaf32c4d6e3068b9aaa882eb35da7d0b3bfd32f4

SHA512
e80cce3dff291e598e080523dd9ce2638470b80b746838451ca0934c10ccd975f543b3830d38488c414d0e5aec4b30cd5e370a6a55f9247226bb35b7f56068ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e2937b7f5e5c549869a87c08ffa02bd9

SHA1
f803d30268d579ffea7c48f033aef146391be7d8

SHA256
ae9165a4da9de5ed9b09d12ce0b13a9595a18f3be09a09cda1decc0492ae0893

SHA512
32a789145a4d758f4e2365fb686e00ff8b085e004b4181ddc73bfc9ce522c9e42aaeff5567cd4d6326487d008186b968a8876e62d9a336d50832cc7a76effc9a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e0ca9176c77dc8338a59f452e131a3f5

SHA1
2918852e837416aaa0633855bcdebb5cb4b65125

SHA256
20dc932607acf45278e338d705df733621e335144e6c3272e915bab59181e5a4

SHA512
460848b024c569a057b57fe1e9904330556d4e7e2959cb16ed42f13598a981ca65f9c528edda3879d97b97370e6cbc99cdc0031a3c7b70311e88295de6804d50

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4ee0256f528dbffb117a456d18b81b7

SHA1
d91114b4b114e22335fabd40c027791ab96e7e39

SHA256
a862959b588dd0fdce8c9c6b574a6e9552a31a05ae18a07d81b75867aaa5cd32

SHA512
dd9de28620610d298e5c52742caadac01c712ceff2c7e8400bfeb110800cbeb04807312754ab53faa92ee401e00068cb4412260bfd6268cf74db9833ec2802a5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5e9277b82d743165d3484a9e85277b83

SHA1
68271103ae8269f33dbebb9aaeef7bd020a68532

SHA256
181ba02207b827ef2f738d864b74c184680bafdbb99ad0476f6314a167fc611a

SHA512
17de2005cdaf44ef68e05421b898797e12f700247df833aa2f39430e22267a58dc537fa19f3ce03ae6539fa207b57940f53f951bc05cbd3c36041c9b16324ce6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
606c34fc8bb92ad780b6f08d62ea6e79

SHA1
d29930d6794bfbe50852ed1909ebe5afc04653c1

SHA256
5526ab205c859f2d62d09c10c98916f450485fc9ee6aedd547ecb7492a7f4174

SHA512
363be09bce7ae0b3bc4dce2554b5353dd3fa0570133d5327ed80ec356df8cf4ac1705de1b9ca6f51f9eff82d4ed7aebee2d162c4e9c4ba61f97e9cc4c9871399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d78013931c5c991bebb4eb5712eaa307

SHA1
b0ec893214c4227889145c25c3c72a59a959d55b

SHA256
7e01857051f7853e8bb71748d5bd3a60431adb8a153126c8f12b35d34e018650

SHA512
293846c79f4efe201c95d9d82db3d34ef1105760e80616b7c916ecf8c2196d6e552e5e744691a379221c1a5111cbcf095ad0fdde7635809dce281d35521ad074

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
637ca587d9559a4b77ddd50e89316bd4

SHA1
719674e85d735dfce906eecc1a689518d9d77d63

SHA256
f0ec7e9c20769cb78feafad490ef60f2a07c208ad05fe3c825fc60932485b485

SHA512
a3216b685563a419e371137311796c77064d4d9c145654eab3c553f42a7d2f2a3b5b167634ac1aca016dd315652e16f6ce80d975daf863685c976100ba685895

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
90f57dceb9280b28d92b26a654d79ce8

SHA1
b2cd99296a4b29ce1fd85ff0f3792390f1f08b02

SHA256
cf78c00c145b1ff01480e4e472d081d11e719763b7c7baee59763c5f450e4102

SHA512
d50faf315b0ec48e2e884c413ed436864c22f2f6408337d52c9926943b69d855100045ab4abf019fb14d9e328e69d9ae3436a0cd3cb040c2479bd67d94d9241e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b0128b56e6b2536188572968c94ba6d1

SHA1
25cb8712b493940926a66d7356fc372ce647c071

SHA256
df590f1fd683a7323fb7d16ba3eda8193cc663568f25c5bb867178d0a9a3a5b3

SHA512
1d17e2776cea3ea031f7deb0e5433c5ddd76066f43d524ce013ea46c812640c20d4a5498bec8dc7875c2c4cd0f368a931142b517d7ce24081b4556772c09c0e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
eda84facbeb9302870aecc75ef733b65

SHA1
7ea2fa782645a39252708168c47a0f77e3cc855c

SHA256
67a33646c69af98c8d88a7d704be8bc2d3e5af2ccbf1795c6cff518d9964ec45

SHA512
50be971ea689526b50dac6f5a123597226bbcbdd06664474f077788f1f268fe11214c9e7706eb214aa119e456fe96f2660424c231a224e79a464dcca5b8cde12

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b4a28b8bfa696f4fb25ad0dd3eac23d3

SHA1
ffa7d5b055d331e45f13087d55bc49f2d7ab8e7e

SHA256
9bb6126865ce2f45ff0d81c6ab89293f25960e6168c85e82606af8079d44d01a

SHA512
7939e9671b90a71003ab0b8fa7b27a27d77764b9672af379502c68fe1475448df7bdad355a75dc6e9749ca7bfcd90f011348b11e9e5cdd74d50a273dec86262b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9cf4be5030d2feb561b547d7708cd0f2

SHA1
cb886908de79d79f66790c72625e632dc2f7b3ea

SHA256
293bf2730f9d8ca3ab3a84bf575f2ed4797cea35dcdfedc65fca6d7ae7775ec9

SHA512
ff9ade2a020b4ebe56d6fe05eda8616e90a21af3d324e7f68a21768c6fbe92bcb85bdda4c4dd22c45b0a80bef7f7e658effa3970241344d457cb0eead930a16a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb6fdd69adbe9c805f84405cf6b876be

SHA1
2a3f836ea7fdc1aa237bc3cb5310ec9b55f617b4

SHA256
fd69d30be39b5b139bc113ea88fd0239e7deec050bef8da508f688d7e303bdaa

SHA512
ba27d63cd7b19195da2f3e58fdf03441b9ae9ea0f58079f7fc3e8054ad438dbf6473c41c2309c21a43341ec969cfd98834355f78d21a7733aa0bfa309e94cb45

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEAFD.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarEB6E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit