ca5b886bef5eb06e30d73ca99449567809e455cc85f9388e92869cba20de634d

Analysis

max time kernel
133s
max time network
127s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 17:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b88f9efe5ce28087a656e8834a7da32c_JaffaCakes118.html
Size

9KB
MD5

b88f9efe5ce28087a656e8834a7da32c
SHA1

89879c6b68a9cd821b3f5e0823433886313db72c
SHA256

ca5b886bef5eb06e30d73ca99449567809e455cc85f9388e92869cba20de634d
SHA512

82c2013716345d40319e98451af4621658c13c3583fef295ffdbbfc481317698716c65c8b27a7efa2513d493a0ab5bcbe6b6f8baf9976e99ca87a2517759bc1a
SSDEEP

96:uzVs+ux7vKLLY1k9o84d12ef7CSTUjwGT/kjgpdJxq6WF/xyVp9elVHcEZ7ru7f:csz7vKAYS/qg6dJqeVp0PHb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000009cd6a95a731d53c4519f12755e17a97abacb2e964d47cff5396c246c4575fc75000000000e8000000002000020000000ba7e667e63fb0cc4bc746fe1a879ddbaee9560cddbe6e5d5892f30c82b41be40900000000172f672c0847475ea3a673a16b9495080a1f4d9c09aa4e1b87c840610baf3bdb95cc193898148aff6a066c04097510ce667354f7534aacc078b5592cb92011cdccaed22a723ae38dd8456d1ff9360ad02a6b3f228cf884530593f593d0418cf99fec7f159e12ec6630a6837c765b1eb2e5d9060a4f6c8c0eaecf9e5fa412b7fe8543c99f69cf07a1e94404330e6138b400000002c95b36574155b056d22ad2bc483a93e23450727713478ab16acadb1534e53735fefdc390376898e743e5513868e930c173064e0bcaafab402f60d63ef0e21d7	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000004b645e1becb97b33c4fed3d7cdd015290eaee0ef31979e728243913c61c4604e000000000e8000000002000020000000c9ca9663147e577cd0bae8ceaabe9ae857ed6f643197bded2037ab06a06f862720000000d4cfd33cd70676d17faa583f1cb1374e2ca57829ee11f8b92a1fd87121ef21a1400000001b6291b8e2de7937f8d991ff03aa65cb5714a763accf07df8f2163e1d05eaa1098b3dd870d701671d4cd157f5676f35083c0a122a85a2756b66048b053c5ded3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f01b4814bcf4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{385693A1-60AF-11EF-8153-46FE39DD2993} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430510983"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3016	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3016	iexplore.exe
3016	iexplore.exe
1656	IEXPLORE.EXE
1656	IEXPLORE.EXE
1656	IEXPLORE.EXE
1656	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 1656	3016	iexplore.exe	30
PID 3016 wrote to memory of 1656	3016	iexplore.exe	30
PID 3016 wrote to memory of 1656	3016	iexplore.exe	30
PID 3016 wrote to memory of 1656	3016	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b88f9efe5ce28087a656e8834a7da32c_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3016 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
45c434048170dbb0fb802290d51ec143

SHA1
5ccee995df701a8d946b8fb894259871d86763f5

SHA256
db022ed6c5248ac43f4985e0ba0c93af2cc6e97ca97f94cd9b645d2cc5663877

SHA512
216e8617087c561095c9d8097c2988ccb556a484d9bfed42b3896e26804963802b7ee27927c120ff1e6e541295540c5ba808acd7abb822a0b1784d37b0c1753d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
030b23ea2dc0c72b998a92dfdb7ac42d

SHA1
b3fb0a976feda0be3ac4ceb3b446d12f3cdc62e4

SHA256
6aa2c1a5db53782fde007a5b0318f69c8868ae12e2b201589f1531cd1d387595

SHA512
787c1189bfaf3094dc24120391d82bac15ad29d94b45cc97c31edce1316739079d5e6a4d2d1cf0038cccc8aa30a842f1c6cbebaf2ed8ce6f35a418a33e503b0b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cf951b768cf586321bb2f6cbf37ad147

SHA1
fac6bc2d73b1cb159156523bb7ddc5645ce7839e

SHA256
454467cb514c39141c5c2252e5ccaec2261f1131ab419062ccd3f4d86a573f4f

SHA512
399a04cc943fcf9446c1def17ea8bdcea065f4433d9fc04ef236cf0bababba1256f633837a47d25b24ffd35e2ac096e9c53fd071e37b2f5d2ecbd4a913821ac1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
47198697adaec83da958fb6d82574ada

SHA1
93643d220b7063089d679d5d425c8831ec49ade8

SHA256
9fa7952518cb9a8c30e3aed95b9cd66c14226e64a53dac86b355d38d9634fe09

SHA512
0d8aae4491f702f96a3efa95048bba0f7124982da0caffe26103b3f11629a867d54feefef1f56e358a7026791215d9c7f05aa93bdcfcf499e7ab542f8ef6f273

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6c1a951e04dab8cce3f413acb65076eb

SHA1
5363f4414d88bb2017496fb36c1bd178fba0df65

SHA256
3b1c8ffb0cb3d9063736de4d0aa014927d06110f16f20f7d42cf10d6419a670f

SHA512
a28510e11869393b5646efb3d494b3b60275e900bc215bea359772874c7ecfe823922fca79baa152054af63c3946b83be5b5217dd54e80a9f951797f0d0c83a7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
974068346208ae53eca86b153982a116

SHA1
5afe163dce079f4949df762abac60c217f13c34c

SHA256
d892a633941f2657f789650fde143430707f36c993cf1ba26a155aca1cf0b4d2

SHA512
7a40b33ddfa61cb9e1764222b043f21c55916ac8c20a97c0f4c5170d7ef8a9dea0857b1622a87147ed58590b332ad90539ca4bfb14ee7f88fe83dc1dc8542a37

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
37abff53988478aa18dfd5153443b03a

SHA1
963a1a797f2719ba9a9a4288c66e62cdbedc88bb

SHA256
292262198766bdb687701c7c696fe8679b3108c6ed63562a2c0d1cf8685e2f19

SHA512
b8b46d333444c7a65335db117958e342f0b3a1377c58de25f622bf0e3a65424d6afc3532cecce2c198539d0f3ae9e90483ede3762ff941000712ea0909c8fed1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9f31fe9c50785306f77768717c4ee386

SHA1
1530412f30a601dfc911c4e60dc3f87a39b481f4

SHA256
c1ca1e5893c8f711169e66e991e9992262e2454342e702855bb878a9878538d8

SHA512
d22250d143e98e70f48fe2fb7b50ddcb76b6e480398ead0af986eb29551075ff06c6fd5fc3b05a67b190f9abf1d04d1f7345dba9b98916850e23c48b3f4e54b8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b9d19edad0d42ee43d02ced8a22be043

SHA1
6a37f209e307bd28ca400c577bd980138a69c9b9

SHA256
cd0ffe09618e5a84fdcc1ae6e3358393ffc46394d6b679e32392996c768473e3

SHA512
af168fa61afe60d1040561537b908fbd0487822f0b90412bee25597d6c31e6253b6743287788866de3a26b0b6e83dd0228265b86a0559e9c7b44a85d21bb513d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5309aaf845d2c512202e8d3552097195

SHA1
d44f2e61c666897805ff4974299c4388c75134d4

SHA256
191a083f031fea7c9f394420e9b855fde8cfb8b454caefe713e40296e0f7bdeb

SHA512
e00a30eded056b90b946066180a434e2ddd2002b4f4c106a1e0a42090efe3c619074296a712c59944d9a17e589011090b955b4e79cc37c072864315ef074a83e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e03afe91ab85421bc347752805d49959

SHA1
879684b3a5c9a620d838dacfc949f139b1d354df

SHA256
756bf93ed228ba533ba2e537c316af20f4e3c3b746d7888cbc8e48f364a31df6

SHA512
d2db945e0c76d898dcab5f55124309fd3c65fe1185cec9f14dc2decaea4ad2a2c466d371e3cb4c2d1f729e19cb36f9015249bf6c20705ebef7f5d72ab14517bc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8e57f671659bf9b27af0c3e02da0ce83

SHA1
cb40148922b658ae1962cb93306c3f2695dd1499

SHA256
5ff8e45ccda8960a062de9c26a7d1654a09a593ffbcb1a02fac45898b13997a0

SHA512
26e9d248a3643f7953c667ad074bf3d792037d32e86da103b28c0439afedf848bf37e0becd263896ae6e8113e306ee41da4caf9b770e1a422321a8aae9e57a70

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
545e3a93b419663ef254c18e20d9da77

SHA1
80e4ec1de98db0528cbd93539cea55683c71964a

SHA256
98924c734f846f5985931fd77bb56766b5cef0736a83ebf45a604207e65f1e95

SHA512
41eb14a20f01c5cf9e856fb637f97446ec56ae8642198f995f395ce4a0b9d7d76700d2f7430a3f5618cfab29521f92222fd8ba894c6dcf8b45e8bba21c356840

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabF173.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarF1F3.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit