08fb255ee4b5742a57b495f943624d7e9b1c1d7bc6a376826621114c6cacaf3e

Analysis

max time kernel
134s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22/08/2024, 19:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8d70ec563a33d196ba4b5366e54a136_JaffaCakes118.html
Size

9KB
MD5

b8d70ec563a33d196ba4b5366e54a136
SHA1

5214680b2072e9bd0bdf9f85fa4fb15f9320c871
SHA256

08fb255ee4b5742a57b495f943624d7e9b1c1d7bc6a376826621114c6cacaf3e
SHA512

5b3d71ac6278f09624564c15f5ea4ad223e3a036e5890eebcaaebf91ecdf5c3559fe1978c8ee837e1108ac6f4f3aaef5eab8f1985ee80e29e0a15885ed684676
SSDEEP

96:SISYG709AFM1ohBhDClekxddbZRydddpsbddd3hywtndddsGnh9dddAKFrDDKpdU:SIS370iimMbWwAUgoyUtNXpuCgqt

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 41 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430516499"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 501b47e5c8f4da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000a93f400e3ba7f32e4c83af5b95dcb93937e09c15c6c53cff6518359588513b51000000000e8000000002000020000000b34edf3fe2025808e57cb3241c5175fbbf2f1b217a522f81227c16deca5ff9fe9000000059342da498cbce776680a5a34e96dbefa5b0bfce4833561c159ed73f4190c490c7a36010bafac0f8bf79d0d8d38839bde9b41857e6c2df871990fbf4ffe9e01b1bcacfdcf0b11d2efeb99587d8979e2ff127ccb31fd53c4e9c8bbc09122268220eb8b8ac23a04156b5904784470e99fca5dc03c2117075f1a5ab3cacd0116ae1667e0068d0306711bdecd5369e0038f04000000075893d1d4e5e194e7004e77eaf32c434340a98ef620b2e5d726998c2f3249b736b61c088c8e465fe6e1ce19ee3fecf3f9ff8eefcc51a7e2fc192273152aab1f0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1027E1B1-60BC-11EF-B8B4-D6FE44FD4752} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003e1c4d4a7885794291b78de8e6dfadfd00000000020000000000106600000001000020000000ba3897d8d5ea8dae6fc312a0ca4941d2d4fa2c4b18074b1acf4864d20719d604000000000e80000000020000200000004458857459f7eea97057864fa11a056c237cabed3b6ac3f34595836892d7118a20000000813f046c3cd92a9b51a221c384a7d414738b2a909ec0d8a8a89e3567d63c13964000000063d4ae254fca8a6d8fd9c3504bb5eef98b95a00be703dd49220e6cc1155c238e3db6f0bec6f5c0649bf84d92f3abf160b9ba4c8c021360f0bac67200a4c333ba	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2972	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2972	iexplore.exe
2972	iexplore.exe
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE
2832	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2972 wrote to memory of 2832	2972	iexplore.exe	29
PID 2972 wrote to memory of 2832	2972	iexplore.exe	29
PID 2972 wrote to memory of 2832	2972	iexplore.exe	29
PID 2972 wrote to memory of 2832	2972	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\b8d70ec563a33d196ba4b5366e54a136_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2972
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2972 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
adfe36c08a76654feb7990514ce47077

SHA1
76165745bcf70abf6664c84c52223f3b714e5a2e

SHA256
3c8a93de29a6d715b07249c54c93c2d5da23acf51a86e5b09c20e9e4f795fb4c

SHA512
84437f940deda40a6fa7fcd8507ce8e10913fdfb61da7dc7d4ebdbdb73085c74866bde7286c67732d01ceed695c14e4cc401e123905d992efd86e416f6f7edf0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
884335eb3f3bfd900c77fd3e97cd0f13

SHA1
fdb40cc23211778b99afae2a02f16ddf2666ef72

SHA256
a0689cf8092267746d0155ba23ca26a929ab977cf44e49d6cccd7d1b0c2e2d50

SHA512
23c3e80af24ba029ea7cfcbbd163b0e94cf1ccfa575665834f316ed432aa1d3249c229aeaf93d6f6103586e92273b082e0ac739709c7c219fa9e189919c5d0c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a9869d8f1ff51b980bac3e8bc10ce507

SHA1
a225631ce715d351c84cf6aa08cd577c5284f121

SHA256
9028489aeec62d44bc7bada552a6110cb31b60588944fe6baa7c2b3619140304

SHA512
51397ae63d20facbf3543a687f1838af47fd2a19311c616f93391204621afcd2bbad5d5c15170e100e5cdd45e59c328462b29732ec0b1304ffcb5d4433248b16

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f1a957d80f8c5dbdeaa0f306c00560a

SHA1
3acf331be762d90d9b2af0e8762d46b088976851

SHA256
549f8f018763fb05b19bb280afc7accecfddf9f802cfe8706ad46ff74ce2d173

SHA512
03fa6a6e1b64eb15aff2f66136512e945597e9e5431e93691e1018a9627bf2f953aa76127808e51ea47fb05eaadfda832a2eec4f6022598904754d9c35feab56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
566c64717a68ab9b361666edaa955d20

SHA1
61c29e0a9f812de1f45ce6c7e3cc226cc10ef251

SHA256
dfea88fd9521a0b655dfa252f57a9257773ab86f124d9f0789ba94ed2e2944f7

SHA512
4e2e81a67571f644f8783150ded992f21920138ef0b5b489a7d7ef0fe065d7f859aaf5043298a06d77ff9cc722f417354c91dc5c90e7222e7a13a8dc501ccdec

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
541fcd188bc67be03edac217afd3de36

SHA1
5fcc30ad4711adb1ec5d1537e081772e66d9192b

SHA256
20fd83b37a31511e8a93cee386a260d800403d241610cc9ba46ffb6d54f7aed9

SHA512
fdd03e6cf7335733e0de107440b70a82cfce52cb5ddead0ffc4088d7722c57819ed7e6cf8b337a756f31f665d8fddf62da548360fa63c114c1f3b4f31e242ae3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3986a73e899074fd897ce2bc7a6f1210

SHA1
8ab9881e7397cab17f99b6730e30032dfb8b58b7

SHA256
33763e09d38d2c2ab1882c5f58b0690f678e7873fb2d0f06f795e5dcdbae0e37

SHA512
4032bffae1376a432bb5f199b624e05a48b32bd43f38b4add2ea9785b63c1720f9d035594bf45dd8c3fd0c62bb8e15ba2a60dd2eaf0f935b67be4bba324b2096

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
51e40ca2e433bf859f2ca271b41935d5

SHA1
fb8e5c88158b2bd0972d7e8b12439f09b0ae40f7

SHA256
ee7c5cab2247ba0e7daaf784281fec1d992f2a0dcbd252ebaa5e5799e3acff4c

SHA512
fd3bb6c051e90a61b2ea0cc9c4d701870da44accd081fd4c089a55567ffc966696dd92b68f420f438a043dba2e40610094805e35eaa07a1a09d9dfa26b1df792

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f7de34a225f1a4fafcb8dc292ed43ae

SHA1
fdc7b2eb94793c641822c701a81515ea2122afa6

SHA256
4727e9b84f283058e9db4254b3fa76960adeb01b89330c6b2dfa85a6b3ce803f

SHA512
198e657b100fb36d3bdc4ff40f43b865da6c10a6b7edbd607fe01d7d1053fa6807f2d0f8033ee9f092996353c1d61135d73e6b469827ec35b73f3dbcaf680f4c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c91bef2c3ea78aebcdb446dfb645822f

SHA1
a8d893a0d542121397780b99b6812fbc863e8236

SHA256
f5ef72447c2ae2b4bf1530a0b70827398bd28813845c1ca1dab12720c69facf6

SHA512
e2d6a6ae2ab50036c248378a1c7fe279a9aa197e2bd0a5b02c8cd84629465037c2e81e9244c1a4bfc088f9b849fcfbadefa9b2d5aff333e1c5cfdf018ec4a045

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8623828c77688bb4def27191cdfefe7d

SHA1
d75cd04ff842a814fb8eecd5a3a795dac0a97a1e

SHA256
618ac9f1ca0be5870c1f1b5aab7de555048a7cbd2ee9ad7812a0ae5b811ecf65

SHA512
3bca168c8aac1a0215c7aee085eee2d5d9c1b1e2ef4ea82959f1b87de68690c5ec81303ead396dd69c6321f12a9abb0be72864ae0286f69cff58de5ccfb03cee

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
35dce9cf0cd8341da92b484dcd680ac0

SHA1
5ced19a6bbcd3f25ed56bf491abff47692f3388b

SHA256
a39494ae5864b6098a35ce674dcc0302ae74b6f282b496edb7b432ff3248d58f

SHA512
7d88e6e514da6bccefa73baef164709f7aac530b1d7d44c894350ad0ffe548d2345ec66c53048a6a02c736153d1ff956a67c561d5c1f3c869264ab1d3a857a7c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
31be4b1dab41000eb65840b552bcf9b7

SHA1
1f57f4458ce67db78f458018ffaa0dfc394695b3

SHA256
d17ebd444d51f2e74126881d4991a4c8be349f005aa08b2151dec53922edea32

SHA512
c80f07aff97e3dc3266903e8fbeacffe4fd54a1922f759812b596d3181e73f261afddb24c2dd33a2425f4e1c730e733971edede647a741cc3a0a79c7c2ea3960

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b331a408a592bf8ba914fbabfab08edb

SHA1
215734af30e59178db5b9311f43077e51290a898

SHA256
b3f10a36ce8990eeca10a8a9dab573263681f46e234851ecba8b33b5a06328a2

SHA512
0e00529250a29d4e4dba1e63af1af149a9094eebb53d567045205e9db7ae4fbf0e94272b53293a93811c439377063f3e2120d9800928f385d18be09d0ce4eb1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab25CB.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar263C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit