18cff2f1f2d8cefcd055b1ab20547cd4b1c776db4af9c907eb7c0492b4fcf02c

Analysis

max time kernel
118s
max time network
127s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23-08-2024 10:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb45c67b52548fca8a884573a9896ed9_JaffaCakes118.html
Size

9KB
MD5

bb45c67b52548fca8a884573a9896ed9
SHA1

9c3449df691f6144ecf774847430f055d08ea355
SHA256

18cff2f1f2d8cefcd055b1ab20547cd4b1c776db4af9c907eb7c0492b4fcf02c
SHA512

8939681c24cd9a288dd714d070e9d99cfaad9caaa18a6126f34cd065d7c1ef166e42e544e467deb48748bd268c5f998af5d068d004d712ce4265b0e6e04cba1a
SSDEEP

96:uzVs+ux7wn6LLY1k9o84d12ef7CSTUKGT/kPsKpUlVHcEZ7ru7f:csz7c6AYS/7LUPHb76f

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f00000000020000000000106600000001000020000000d87b7812603963a2d091d55878d5f8c5f0d8ef0de931f4593c2b34677ccb2cde000000000e80000000020000200000009175e2d76b9e1271e527514bd2e474e3a12086cc2667148c1ef7273db4c47b6b20000000e330e458d28461523652fef763d6f7d2d9ca1f4f26b814f928480945b7a7f540400000000dc4ad49f1a69a846daf776a6c9e2598d35d143f61e13f456f90c31c381c8f02505239dc526a86ad47306fbcaacae3949ee922fb08ebdc702148663157252c72	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430569109"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8E264641-6136-11EF-AB78-F235D470040A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30bdfc6443f5da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000082ebb0b9d6f3f0458e93e15bd38f268f000000000200000000001066000000010000200000009a2b6f9a76a49c58a0978826f64f09f1a9e79eb0a1b56149ec272ccb7fbad795000000000e8000000002000020000000770567077d84358dc2e61f45b6576d8576c4d24604b7a57fb8a23ce177a0f39b9000000091b031754fa258006d4dc0c454e69c589601fbb6343946da079826fdd487d6b345d964323f828a1d8c76f0896dd477d858fd892d503b3b467d30ad5954219cbf6ef9cb75d4a0d5134dcb9bae256af5b8571ef5fcde91bc1298109219ac9ed72eb9e376ead793ae2ccd70a950b70622dde0ced327aa645c07102ca633c955980e74db65626236d04eff3fb5c43763ecee40000000477eae46de750617f00d348ed815520aa7a332b7e3df07b1a6958fa2031f5365df9773115e2499f7db138ca888b6e18dbc1fd97a29e5b3382707b377a87dffdc	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
768	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
768	iexplore.exe
768	iexplore.exe
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE
2540	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 768 wrote to memory of 2540	768	iexplore.exe	30
PID 768 wrote to memory of 2540	768	iexplore.exe	30
PID 768 wrote to memory of 2540	768	iexplore.exe	30
PID 768 wrote to memory of 2540	768	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bb45c67b52548fca8a884573a9896ed9_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:768
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:768 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5abbdcae98369a47d3bdb7e1a71e02f3

SHA1
b89133256728cf78bc0207132312c032a591a3a0

SHA256
3e88c9f5571af96df955621eb062284ddc65cc6451489343d17a7c0680decd25

SHA512
1681d8999d3fc103ae0a6afec3e432c0e515344e2fcf4895917103d29c026f87582f334d4334ae6367e6f79b7aaab727c27f781f9efa6c6220da04400e35f9ce

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2fb71d34db626b54d21bf89da4eb7bf3

SHA1
b8b9c50318935492d275ce4720684b96b4536198

SHA256
1092ade21fb805447262ece3a3d7fab891ef69b0bdfbbc3f38ac545a8c30a5b8

SHA512
3a6112e29ea838e561b12c46f4773f8d2fb661b1d301347bfb80e76b5a95dcb7624e061d534d4ef5215f4547b09da038f87abbf9f42e2a8ebde7353bea525cd4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e9588c9ec87ddf886e4e868c43698f85

SHA1
6f6e7aad61305ebb3dbe66b372ff533ad484d1db

SHA256
44a13fd8e9a0a78b14120f56a7c522188a8e21b7e49ad503eb469e5ae584fac6

SHA512
54f638c8f1bfea6a6003699db772e85a76f240a485067b20663bbd1b71f9a03ac3ca9f38c1588cb1691e4e8211fca67ec47990fbaf446269e5a1b812a71d03a1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9ac58ccd28644fcec98596a24f8f51f8

SHA1
5c01a09b4517eba46dfc71c8551c45bfe19da964

SHA256
ee2a7b31ce36ae6d79a4eef6c0f1206a453f011ce2db01431582424ecac3ad31

SHA512
ecc6a0a2c85469600b7d070fcbb93d1116613808f201d02bdcde9331241bad332eb8042f072dbba02bc33e04570e8350c1d7e3d1ea0bfa8af8db74f19bbbe97b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00b0a5c4c39c4b253825c1e4ba205486

SHA1
2d729dc41f60d58372f0846a22163c4dd31a3d99

SHA256
6b44d13c6cf210c4123fd431626f13b9ca84b4303b58c228d93620d0d5c447f2

SHA512
809176cf04f2baaae7c614c36596854bec9c640ce8cbbada3e0db4c7d8182ac11ae784d439f7f416678157e0c35cc689cb3b355e0f4cdaec5b1d0121dc726487

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb1184819de3cee430954ec75aba5997

SHA1
656d78c8577291519175a19f208e960863c35c3f

SHA256
572dc3bb217f6c7d0793ab7d4290ee0aa87070c7f4cca25164d91476e6ddecbd

SHA512
07297fcd5a5e59d5c39a2f649ffa87abf228466461ec85a13fad6af1976b5d176db66f493b19a14364a73834b9d75b4c93a69bc062e388a990d92a36e556f1c2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d11fa841c8e293742aae69fccada3282

SHA1
3acd6bb218e7f9fc33943b9d77e48d6db991e7d1

SHA256
1a7efa5544411a08fd882eafb37ff0d29b4857f918e135b2b1532d47f12ad414

SHA512
39f519b67072d1a6a49e9fb74baeccca898dbc4ebebb0ddb2284e74a250d93e71f52ce0764385e6547e2aac7a6d4ebf36c207c12432eab04e7d6b4d47a117896

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f26cdcb0c10bbbe1f9953ccf9090a31e

SHA1
4674e3bda57e097e4fdc61d2e6b5621f8122f339

SHA256
99996d298e96aeb9972bc9051ff50174da90bdff85144cab36dd32b35cfb04ae

SHA512
897365698204dba3b8231fd9b20941c1f94e5ca7ec66fe454d65efb9b2b5e2fb272fe7d2105b499740e31fd2eae79db98da6250a43b1fcb015201a3c9db8013a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
77adba10a325bb049e79eb1a4ca3488c

SHA1
19543ad3a859efa05309c22164d748601aa1a6ad

SHA256
5e838d2074d38d13213ec272e9704474ef49409c832bf23cfe40f45a791bf918

SHA512
f59faaa80dd5d63aea1d026baccf8a91b35c3bc26b17964d5bb15e0a75ab491d4b718d99e26a72a0d1a3fab96d57afda37f15ceca0c3da9eef52f3b15edb625b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
880d13d7ebc4ef020370cff1b1241bf4

SHA1
63316c0fb9f1b21330d7d377476c6be36c0a29a6

SHA256
0c2cf59beb36f1441a53c03055f46ae47d5598d139cda9ba4e9a0bfe50fae3fb

SHA512
6ee06dd00d532c790cff0171228e4afe1aada1b2d826bee6b81ad5f4fc1315096713f5c44e2aade980856388d956fe32408f632a8efd6a790b59c8e1a827af30

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bcbc7ed84edf59a3566ef640a58a4bea

SHA1
dd29a52f5dacb09c03cfaa4508daefecb619f179

SHA256
2956baa932c43bf3cde6d224309ec77617031a73018ab937833f3843292eac57

SHA512
fa9a618029c1edb7f6d6e05397e7607c669a81534f5d6b67a4b2e30e93e20515226db165054213358cbfd0430f5c93feee6e61b51acdd6535278bebddb6f05ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD74F.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD7FD.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit