766d35667d916a638e239373d127ce27773ac9391654070b6f075a061eb3b630

Analysis

max time kernel
145s
max time network
148s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 17:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b8932f09b67dd29de2b36146b7f9cb45_JaffaCakes118.html
Size

147KB
MD5

b8932f09b67dd29de2b36146b7f9cb45
SHA1

ff599a736ec42898efed8e40f68e676644a4621d
SHA256

766d35667d916a638e239373d127ce27773ac9391654070b6f075a061eb3b630
SHA512

a931dd449ebe98cf0c58749a938724a1bafb368d25573c189b9d9ef5108dcfad04174f610dea58714cea36b27d10fb8d33e765e7e27d6586cf301a3fa0a7fbec
SSDEEP

1536:pbMjw2fMk1D3O9Pj2fcKve5HAkxL6akBeZcZtM06kp:sA5xL5E

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{FB408E71-60AF-11EF-9AE5-CA26F3F7E98A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb000000000002000000000010660000000100002000000076ad15e58cc5369ffd698440abac3c155b7e9188b2330240d9f0643e7b1eb2dd000000000e800000000200002000000067c91101d012602b8ac1debd16b854378cdd197b936c8f4d16bc39601de4f6d5200000006dbc140a96b8555a8efe5c234b3ffd061589762cd1333b308cc9eb625fa6d537400000000d711fcdb25f39f089ca37a550ad4f1903029150642a51656468338d69f9064fbb1a2649a7a0bea04d0e7b3810aa9192a5f130d04745970497c84f4769caf32c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e337bacba951544a9a832c52e69bfb00000000000200000000001066000000010000200000006fcd46f16bcc4af70e4bf6490e22866afcf8e6cf438aae073a389b77f29fde0a000000000e8000000002000020000000901e5d0b0aa6f35e9d6dca3bf8d976f3fe7103fec788bfd6d1dccefcda6f10d090000000e94b62223ca2c7ebee0f4f4734e06333e71c3b60666c28d93e8fc261abdb74e004fdd5f1128b7511c4aa16f02bd1414b38dd9e97e74d48f04e9a8bd614b6bd3e4d1312891a0d7eb3abd5d397c351495dfe244c77ee6a7c15ce2fd92fed919e404536709f3ddc77a7f5f39b42411a4af8a049ba5f84a5a57b8d236cf7cb6fa4fb3e3f96f83a656bc7b71bdd27581636a54000000092d5a151a1d91b8d7ef4697fa595bc2ecd4d17aed6dacf4c28860d8ae88d0b1bb1bd4df1c612db3aafdaeb32cdb7f0e3c03b06baf6da79f8263283baf2f3e9d2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430511310"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 003cc5e8bcf4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1768	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1768	iexplore.exe
1768	iexplore.exe
2428	IEXPLORE.EXE
2428	IEXPLORE.EXE
2428	IEXPLORE.EXE
2428	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 2428	1768	iexplore.exe	30
PID 1768 wrote to memory of 2428	1768	iexplore.exe	30
PID 1768 wrote to memory of 2428	1768	iexplore.exe	30
PID 1768 wrote to memory of 2428	1768	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b8932f09b67dd29de2b36146b7f9cb45_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1768 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
8d64a04bcc5fd9e6255da49ca55bb45a

SHA1
1e76e2b04bd78df6dac04bbeed6790bb10727659

SHA256
d35b1566b3d8baaf41c02199bf09d99d7e3f34990bf0e99b8d662122c6df259c

SHA512
bf8181f93e01f9c953c54e8ba6bfca35df2dac621062a1253250bb5a262d01c7babed45c29a7076a945ba1ef2182d1cef705c4e2c482501308d2cd08873998a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2e29e46f57264520687725d6205fb1d

SHA1
172043d38918ef9100d0d8d6c188d491502a57fc

SHA256
c87755173567f00b42ef425f00f7ca03df5087c996c162d708ee8638d332d5d7

SHA512
7834d3f45565f9b900686351744b5853b3975aa2b561f1b5af352b67e69a2494f7d3412a4bbb8e42400d3e9598ac3321738d3fd49c4414f86f482f1d91cea5e7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0ffc79646749e604c0ed112bbce4d6d6

SHA1
4496ad8ccc1f86d31fc5a37389161b0a46881417

SHA256
23b45e231027e9b5879abe630c5926d5a692855803f282b5c69c9017012578e1

SHA512
396c158b26065a1b139bfc3f88ed270c4de7cead4b339ef31a811cbae13caf401d357fdab83cc32f2d6d5703e78f2f74489d28cc593489a428a49141904762dc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6b1d19258c7f29f2c45ef042862f154e

SHA1
38f465b531527d836ad3e089d6b0242b25a34a70

SHA256
604b8210ebb2136895b74dcdfd16fdb5e75a2c64b697b30da9c569c9d6d39f8e

SHA512
f51f40504a9981ac8a2ee1393b43d8868486f5bcedf16fccbda338f13cb6b2d7da027e7035c61931f6135f7d741627cc3f9d971452e329e85f9883ad0a9fbd74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c7d4fe22c4592ed1656475745fb90e6b

SHA1
6b14eaf9a1e7cb3b1cdd8c58a6b088bf8646a1a0

SHA256
fd608274729c176fe262fb0751b6849478625f3e1fd4e312b7192834a72a4950

SHA512
3687af46623f3a864bb9b5bfc4910ae5a9d8d03c59e731d285314187d82434f27d25db7ffb13c8fe3a589c7d873dcee9bf7cfb5f6b76c750e06e141fb1aa0bf5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
130b3d8b1e4b0920e9386ffd790be80d

SHA1
29751f4e4382b7c09c5362f738ab240e7c6e72f5

SHA256
122687a9f52aa1b272b0a7a2256796b1e38918775e154f2bd9a6bad0b90900a9

SHA512
ad0c1b58b2db7c6bd134ca425628612ca981c7c8f157c784e5f94bcbda348ab85875d0f45d277c717735dad6ab2dc597f38837c35d885e81b981dd6d829ed5bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a1f43903e908fee46ca247f0e431f2a

SHA1
74b0b38faf6e9ddc207140d9ab622fae88ed8d26

SHA256
c09cbb25fb3d8e7c9b63e62c636d24af72e48a1094f9b9234ac4b548bc9b49ff

SHA512
0b6abed4542b6bb3a0a8b12f79e313f8a039ec7a9b7266c0fcdb5462b0303c9526069a61d1551d7ce8f1f67908ccca77703c8fba82e821c006997df552cad19d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
10abb20d9f23a1bc973ea78ba74a34a6

SHA1
d7c5691149c69ad5381258cfcf5056b5d78adbb2

SHA256
d96e82b3be027cf230f93f8122665d53d7e64a2b78bdd9323cde8fcb54387b57

SHA512
af9027dcbab64efcfd118b6885e9e175013758fd338921f4a9f9cc9c5c02f42075a70de8520c7d97c87bf4fe1462b3d182feebf3d0d1eca7a47a4dd839f168ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ffe9f6a6deeafef914e7e038b60f6ac4

SHA1
eeaed3c5c297fd67b5058cf736f663065e10aa69

SHA256
efded2fd3b0ad5728334c3970add17219985fe578d7b1b553e4f57a45f605211

SHA512
4096cd193f54759f5d750ce66bcfbe41065d76c04415b339f1c06293778b57a746db6b04a2bd32fae1c9ef1fd9ae5b35c635124995f948d780fb200eb7f2b25f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
e5cb6a23443fee5ad4f18359fad2f940

SHA1
d1b88d7a0103bd84368c85f5bbd394f7927dbd06

SHA256
7020de24155812a4812194b04a8d2a5937d13ed17b5632adf6b3893480f217ab

SHA512
3f0c4445957bf70cbeec3273aa1df85d7c8813fcb30a59d749d3a50f6feba6bb5e9a04a27b8d67f29f5f9946f6499a7e76687ab4f89f622884051f24a268006b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
bc7b81be469ae12b1efc462f9210c356

SHA1
09e22dfa69fdf3bf3249216cbbfa41bba1805c43

SHA256
dfbedd9a8c290a57b2893bdf83044b358c666abc40c51679db84e4146c3f72b7

SHA512
2117a455c97c77a98b93fadefcf6a61b81a8ef3291af488220827139e35996de01279653eb4655b09c79134b3feb8d09a13878df7333c59d7d0f13f6ca6ed65c

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabC100.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC1BE.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit