c27aab0dcea9337ead2af63e7611ec777378bf0ba354d00527273f63714a5ebd

Analysis

max time kernel
121s
max time network
148s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 18:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8a5561c77549d9d927c5d74b01b295b_JaffaCakes118.html
Size

53KB
MD5

b8a5561c77549d9d927c5d74b01b295b
SHA1

30a2a9f8b3bb00a4f2b477be4c12c29d24a69219
SHA256

c27aab0dcea9337ead2af63e7611ec777378bf0ba354d00527273f63714a5ebd
SHA512

6579d45b713d638dd9e446d5b08e091d1b2fdc1e25c6a8453f70a8e71bd9b592fc8eefa00ce0bd9ce46a714f1638fdf2b7707aee36a7fad1052eef948c92d3bc
SSDEEP

1536:CkgUiIakTqGivi+PyUSrunlYX63Nj+q5VyvR0w2AzTICbbqoQ/t9M/dNwIUEDmDt:CkgUiIakTqGivi+PyUSrunlYX63Nj+qp

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90107c3dc0f4da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000dfef132f5eed261f697a39c62dd392e960d3ba973b58767eac19ba2695f3f779000000000e8000000002000020000000c9914235e5f41cec1d80ba5ed878466a0b1a5269179ffb26f4d0f97c0cdebf7220000000087b1b7b4d26d2b5a44bb088a23524b8a12b73aa39fd5289c6a191a1e8c8bc9c40000000e195b68b0a5f754dd3d67a88ba027d580a3a27853cc91cf56518f5f9649d321024ca2964a93dda9f235f5d2297665fcae8a8b35a3d1175a72a51c35440d530f6	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000906d465f88e9e33d525c900428f799bc9fadfe074b3de99f31ce04d1fade5472000000000e800000000200002000000084a263062d1c43b3b9dfc1da4f6761eac2e3a832be9dccd13214d68d1ba2118290000000aa6b08a607e60b14c3d575655975958b80b332b0b7c5e099f5732bb5ebef9dcaecd36c02bef1fd731966882e73aa965a421d55cb992924c5d01ab7220885a9003ed402951fc00d7039d4536599b96c9850e3fe8a297537e03b8767e8e26928a423365115aef9ec14f8b0771c5ee205b7dcf22165acdd9a9b0d0f1a05d40bcd35f35dae360b405bff4a9f41670e62aaad40000000a5cbaa9414827a83b767ec4670d545a50dd740c5ebb64fe8c21932a253f8d60ad7a1cb279b06fdafabe2b179a7ce8f93539e4346956f6d256cf62141692b5fce	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{4D42CA51-60B3-11EF-97BF-72D30ED4C808} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430512737"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2976	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2976	iexplore.exe
2976	iexplore.exe
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE
2712	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2712	2976	iexplore.exe	30
PID 2976 wrote to memory of 2712	2976	iexplore.exe	30
PID 2976 wrote to memory of 2712	2976	iexplore.exe	30
PID 2976 wrote to memory of 2712	2976	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b8a5561c77549d9d927c5d74b01b295b_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2976 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3a18d8fe5f3b43ed6c5a2eb6c8014798

SHA1
db9ef86b6b24770b4bbfc6564efc82d35cb5205e

SHA256
aa069ce2faf5333b809bdef4bf15c80ed9eabadfd119d933e6efbf11f74437e7

SHA512
2adbb250deca2ffdb24b74eb8b3879e36996470a20a150b986926ba4dee5d41551add5a00ec26d0f460d78450a3d2fa5cd6d7a91bae703d5799e24b23210f9bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8af5123001bdb9e0a4cc2649a6fa2311

SHA1
9db075c08b7c71582d6eb822ee11e200cc140ad6

SHA256
e4115e1a631ac7d56b800e394a008897156c1fc9293ff7dc0809967ec906f2d4

SHA512
d9299e91d1f2508adc99362229703981712531729ac6a232ce9b0ab367ab38c454cfee11784468417cf56ed112916b899180d3d4d7630a31499ee0e631bc86d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a4a8b42ad2c6a4e361316b75fb3b1885

SHA1
78a4df8da26c20c57d03283f7c433c1a01ba8248

SHA256
db2aa3b3c9c6ee9b14ed111ab83b17f487600b404ae54d2b0ba969c63b881470

SHA512
e1fd2c2306f96cc67131d2d37d7116f923529360a8780c16876f7f78980d7931e7f4472e8cfe220d0b0ad118534b4fbde719f633099b0b6a0fbbd9fb5b249235

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4d21e790562e7bf24b56e957b9050e82

SHA1
d82e7807898a4bda54b4878b6f2e64fa85a290ea

SHA256
ce9f1760eceb0a22801d5fc862b0f899b2ba3858b2fada5898a6db05522fc5a8

SHA512
482dee718f49abcd89158d33bf3acf7c49b01afeb17d18a714ad5e728c8023bd457bb4f31a20854c135712eccc6ef66f1be299d8ec34392c7769e5bff4f68729

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d2591cf342c027de3211b7e91577b3ee

SHA1
1665ae613c99342ab3e72463ef057b5479de3b0a

SHA256
1c92ad4cc6241c4ec8ce0264caf5711151bc4f9a585b658e578412b1fdac19ba

SHA512
0c72363f00b7b07c6e3acb1c41ece5b730de345985d89d4b602a2f2b859098f1ed4d758b17c2a7df35fd0bffd2562d8776189d58b7cf5872dcca79925c93edea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e656b4e92ef4a32b9781578507830e0d

SHA1
563d5aabec66203979c2cf90ba6236f49dbdcf87

SHA256
41cd771abe67c8a2c740fc52908136fd992fac55935178f140c37f565e38a063

SHA512
86270ff1366ee5c72c9b8b2e812ab4b9002295f51b2301ff173f24df28ecf978cdaa69446b4de8b87aff6cecc0a4b545a7507ecc6f0b39c1c7157bc1f15fc881

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77d90cff31bcd71d825fd2d211272df4

SHA1
4f1d0973ed78b8d6f164be94b6caeb10e8e80e1e

SHA256
26375cbf96d44061e11b5d0905117af434d7235b99b783e1b34aa1c04ba345ea

SHA512
54232afac96200bbfba6cc7ce9554cbab1b9f05893f15dfd582a6a679be9aa8c9d040db7dfe42a25b0b54b5a430ccef878d1282280b921bc377e2d13a2294e5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e081b37622692bd36ee213ee0cc94cb

SHA1
888be02bbc523570db3b263b4bb5bb12da2f4f3c

SHA256
c92e6206c53828584802dec5a764cbfbec4441ac5015d303ccafd35543d9ffee

SHA512
84444793ed9fa6b2f9207802084e3f22e20ad8f860845c67a84ec5d979706a29fa6a978a91f57fe2ef9c2a9c803f3f02d42f6683a703ee2dc4f26765418aea5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5387ab238780e9f53a9fe233a8338d56

SHA1
635c9a2981014c6542050321690a22db5a4f348d

SHA256
f4fd6426c63972ab977784b6096ee150b51ccf918075b5a4ccd7afa18792e450

SHA512
e6f0e51bfb2e67e8f5716c0104efc632a309d52e29b86c57e16e74116c264d3e44dd322d6ceb69438455db3465f5e47834f0d6647caef1091b46004ccb8871aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
912174cd8f42290bd80a0bc1238daf3c

SHA1
184eea1910862a7568ed3968a3963c0d3c9f7c8c

SHA256
f59ea301e0bdb17a1682b3379dcaa57feb844c711c4cbef9f130c33bd0acab72

SHA512
8c739362409852a2fdd3ca2ddae0003a9b7bf612ac420449cf678f66b11b4285d288ef90913bd34a6466961ac369aaeaf4b3330b10ff084cf863e88df97fab8b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
569bad5e4d32e4e2636f606b4557a768

SHA1
6bb63f7d0e384292671dcf268cdd406e407ac808

SHA256
465f49ac2d85ef6e4f3256bac91c574a3ddf01870c4b5b2df55c44fd1f5a30ef

SHA512
93abb3bc1daa11109832b7e7cc43c679d4eb614e2c96974445f70277a3b455ff15265c697ffc3170407bedc556049c9c6093e9b322cc87ddaf3e4ff3272194e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2e074b6df22135529625346d2d69149e

SHA1
302e67e49f023203ace1b556a62add774f0633c0

SHA256
a996fa5632aed567aca0647bd15f3d54e5036b11d34337c7bcd48978b5b3696b

SHA512
297271bfebb1a94555ee25b1bf1b70e5e822a4c45238cafb4cd380dd86620c36b5f71d836b7072edee3f4be45540b01a085f5627468923f888897e0d73ad9115

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b66314ffbdb502c6890be70743a82d09

SHA1
a1cf6c4dbee2509ec8b31bef4ca41aa5d05a0006

SHA256
b96d95cee1ec255c4031ecd541495991dff4777dd74e3ef647f27d08931e12f5

SHA512
a6b0e1991eafdb8935016a9071a6b3d347e360600a9010c1232b5d391bf4ddc98be566d1cf954daeae071897776bcc41641dbfc80f4993b64ed256e34d14c5a0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f4ef3d904503f8f85fce2194bf02713b

SHA1
951d8eefc02e5827a9b2a04d7dc4aee5fabf0ad3

SHA256
72abf577e433c222a67ffa3346f96f4ffd18f799dc7d738e7ece81c4e4065984

SHA512
070b59445545ed74e2bef8ea32409c70c1bed70bca38c845690be8b16378ac5640dd65a55e936d1e992fb2a4f7fc3b79c99d8c19dbec2b303ffd56f39a96bc7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\84EXSCRK\wt-logo[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab4625.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar480E.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit