c6bf600e0827c0a9034293e8ba853434a54c7f87454541e938a3733e7ded9643

Analysis

max time kernel
133s
max time network
130s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 10:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb564f4e3d898ea58b285557b2fc95c5_JaffaCakes118.html
Size

3KB
MD5

bb564f4e3d898ea58b285557b2fc95c5
SHA1

bb9e8c81f9bcd2c1b8bb66e0414dc6bd72d6cdce
SHA256

c6bf600e0827c0a9034293e8ba853434a54c7f87454541e938a3733e7ded9643
SHA512

db89548ae7916e364594e30e66f2ae76ab27798c07c7b1969e3e7c983c7f50e10e4f6a8273fb98a3812f07040c07565c2189780d7267e879b936d5e0c309e15a

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430570326"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000905ee82b308c66e6f2f2e8d0c7463d8f71887b4b97784294a54dad9b74718521000000000e800000000200002000000046a01d3b4bb96a467bf27f1625c397adf06217cef20b35e64746c5e6bd9826289000000072857fceabb098a2b1b76252091ec843eb8ad1043f88c5b8de2fabd4868ea4dce9001fe431c9a0cb4d3c2c820dee0c1767bd9637a47b85c24383ea6c957b1839f5157620179f53b41e6f373aa45b535301d3de40cce55dec5ed52d37e67772b72419a3904ebd3aa89fe49a8f4f13f0d1d250757ebe5b54ab94bb7ee8fde7a11a42b65f80a45f65ec49285510dc64360a40000000d263a2b660d8b12ee8d5c3ff0a35b0b9d017daf37e5d8c9f2d73513615a8a3e57e05bca31e6a1264c6d15fd0b35fc4be62f9d11ca1a164a4327e4534cdf8db9e	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{625E15D1-6139-11EF-A1FD-CAD9DE6C860B} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004961a9603b5d8740891a04601e8b8fb900000000020000000000106600000001000020000000e54e2b477ec66facd59d1bb86f747274e86b0f9d0cee6c1fd72f4d5183a96a60000000000e8000000002000020000000a97f8b42826cb6e5360c206e77ed4c7cfb1182290b743c7937f355836b8ecb72200000002a52b5de80902acaed88d28f3aa870787d8118558554ea70937ab98eee002c0940000000f428184cccaaa2ba33aa6a037e72461bf03a9072523e38e75768ece6740615897821f6cd293fc8b360279d7831e1ddf8a541d4d62d1e8245176808d993b47d59	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 202b132546f5da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2120	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2120	iexplore.exe
2120	iexplore.exe
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE
2472	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2472	2120	iexplore.exe	31
PID 2120 wrote to memory of 2472	2120	iexplore.exe	31
PID 2120 wrote to memory of 2472	2120	iexplore.exe	31
PID 2120 wrote to memory of 2472	2120	iexplore.exe	31

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bb564f4e3d898ea58b285557b2fc95c5_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2120 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
85807bdffe6ee7627538f9e8f77214bb

SHA1
2bc9d586bd013ade5386cbca3d186e66d76eb89c

SHA256
f2f93d22241bb1d79d70af4fed496b8fb492e0bf4c259921ade9c06a6231ae65

SHA512
759dc8b9bc1042a66baf9f03e8bbb18294d76ae35a0f92e6d4af1df5b89e0f88deb268e83f4fbc4f5b50c7505f9bed3908d5d7d51c0b30c7e7d855261d390c78

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2bb78dafab9f69cb2d33e437b0dce276

SHA1
fbf40ab593b3fe9cfe6e81d8d2fc7dbe6a605944

SHA256
5dc3a051ad4e832b59ddd2326dba140e9986be3474c543e7d0360dd4fe9031ad

SHA512
adb077376e9f6f2aa850b83dfc8e1de7872ab6b67fe5c962d6e656c3f8883b3c2fd9d98128d0683b69ee00ea4d311e1ce1d97f93c97d4308174f919959291e4f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8636c63e2b6864065c779e85d77aa28a

SHA1
8ceba3c097a36d8ddee324eccaebf0963c4bfdde

SHA256
116f18a322a2e7ece7ec274ac8a49bde6903a8d2ea9fa8c204085ecbd817c6fe

SHA512
851392531d9f1048a0126a4386671912ae7a7b06d7f9a294330f5a355fee7958f01e2ba5c48ccaa90edfc087ba0725de7997f3d058ecf6790383b647549bfa2e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
896bd5edb7e992493ca086791886d6fa

SHA1
a58705660b417c153def0a9f4df6459431859f15

SHA256
4670f1d810f42eaf7bc11772706a3fe494a1718fec8fb2745c16edca44e601ef

SHA512
d4c9803c3ad6fcd485f177a2d6e446866e282f5360feee4d94f59eb60cdf1ac7ae3f062105c5a7845f125721caed1df6dab687b15074b4121d48cd7afe566bef

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c30af7110c6f731db52fb542aca89dda

SHA1
6917714631a11b42dd0b8fa7e08d36a00c85af00

SHA256
912a840a53af4288353d7176d6625081936f4f879acf4883afdf9ae819f9f185

SHA512
848e5c7b2aabef76577fcd3cf8722039b4227237bdbccd0d6d93a0baf20b76dea21e95eabc13daa007d9659581468c0fd0fdeac4c3e298029e9bd9cb096df1e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a660ff1c2b1847336e3263acb2f1fef8

SHA1
e7d27b956aee8f0c47f82eadbaebcca8384479b9

SHA256
c443a9eeb710351c5f680639dbf4ee93997a39550c37877cf3ae711c40bad76b

SHA512
b955744d81be8793a6a0dca8fc3c9de7de49fbe101641cf13a6e3d3cdadd081af4021d8931b4a177b80da476d4eec1020a71ba5d0cfccc987d9ce13ca8be784b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dc6da2106af12ef5af7c392eca242756

SHA1
2f9fe8cefde20ff0bfdaf5e2e340f120a202e2fb

SHA256
b4df605dfe251121623d99e1c3d1b8e006ac96b987ea4c09b1c6a3a40b727da8

SHA512
92c4b60f7a15da19eac97283ef8de600c67b3c93e26bbc141a8a7adb53ffa2b16c939cf93d7788e6204bb65aad91462b481231228ef5746620cdabc1dd2ea919

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e12ba5ec3cee0b46f481f072ee2184bd

SHA1
427f0ce3dce5d6efd41f36ce0146f80035120c30

SHA256
42a059f2fc8eda1b526435d5d9436c41a18a0dae077fd42ec2c800a392d882d4

SHA512
909cd5aec0ff7d9bc17139a570aca2503bda3946714a4ac98bb736188fa3a3e00dd3395729fe2503f0913dfdfc2325c26aa35ce95ebdfc50d90d68853c3c26e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
22260fb89a50518d58e00386300153bc

SHA1
b504db138e656d5aa6f1ed10f7a7f05965207530

SHA256
c62ca66d7239a855928428faea6b95358bae6858a1882fedf06001fad121b38e

SHA512
5a65c9a65c43aa681d3ccc9f44fef8f700de2b992b42485034768c351461b6611f6dd1215e87e353192444f5fc269fac101298525f07df1f9f086dffa13bb615

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8f0a45a9f392b65661019d93215cce38

SHA1
7b62b20786f33994af429971e4f37397a19d7ee1

SHA256
d58df54e85a799a27711571bbb42e58ff7c6784e6cb5fd0fdf062b099a209259

SHA512
6eaff60914f00e9cbff6c6ef3018a63b9c1ae13c8bafb966b64e8f78dcca917480a6adacb43816127733c2f72c0acc171c9ced63086fb822976c6926009449d4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b3e3bc75ea5b86faeb4f541f172616d2

SHA1
08768fd27b5af638d841d5b9e3783015ee02582f

SHA256
d1db8d23bbf78a5f0b40145441d7fad381a0b7367a5eddc1d504f83eb133546c

SHA512
5faeebffb90fe1bfbc9ab1dda8abcce8c9cca88df4b8156aefe6383da2f81a17ec808f1d86a3d0630d99f0b9307e2c9368fecbbb296a29b14241dbdcb0ec90cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
20d211655e696fd7f00d71182531e679

SHA1
250f1beef7d3fb9aeec4a0c3509b1a5e115995bd

SHA256
e296de843d0e23d7d0fe35f4c0103d036fa036e18b15aa3e5f4cacf8cc0bdf38

SHA512
7435fd4ea85be2f005d6b38668220eb626e3c29e23c4a4287ef683a8d8cff314117d864eb93fc49c246ed74287708e2e4f9cde02e3058725b4b98c686b8ee74b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
01d195e9fe3bf0da8eb9a45b458054b5

SHA1
203fc5df835ae121124a9860f90f04216355cba3

SHA256
9e7bfda49b2341d8b9c753b885acbb038fa757b7772549b0e111a6061f75f841

SHA512
d570f4d2558ce368898a0d6168437b9f92581addc995e09ad7161b3c38b47d09cb7e9367308259e59aa6b042f80bedf2b061133c59d7eafd27e4436bd50a2c75

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
480c344e5bf92ea6588f2610be4d3edd

SHA1
35994bba4c0db7ad23262d19239683fea130e550

SHA256
1e1509440619377ed40d4775fba9e21ae34c6fbfc5cd17160b05e1e1af8b444c

SHA512
4148d60b785938e88931bcf5c17104552d83269b234071304ffa9682467712b0b20e552cbbffc30404f3a43f5105f8fe539e34f83df8ac704006495b3807347c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
62eadf18d7e431df527fab1443e756f6

SHA1
e5fd894cf90bd6836fefbf359d0e4a7e44292721

SHA256
d5b5cdc70f2a60a9f9593a4c06e4baa4fd0e4a0871cf21f4c0c6a25171f51b35

SHA512
e6624f637eda81cc011751a99e95c1399a924ac764d5972789e30bff2a9e03c95eefc55e433d14f04395048eeef89878ab373ed5e110dd392a67ca2f8c3a6ef7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
32581d1c8c4383a687d79bcf478a5dea

SHA1
37f87c1639819582782763ccc3455021179dca74

SHA256
d8fff89bde2862212639a597684cd7d89550c861e9f1b846729d45eee8d590ff

SHA512
6a5fe0064801de728d4216c8d582c3befe1f953e82d80c93ac219b78f45496cd2400e90c0fc448ef282246d0e86e118adab188ba233fbc65ef951dfdf27a0cdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
bebfcd5a36f693e0de4679c455ed88cf

SHA1
7183c0ba945df18007365fd554e603a2e0483d03

SHA256
99aacc5712a1b1635ad728985a8a22f455daea9ef8cac7c02aba0dd0b2a9cced

SHA512
3bfa94a5735365c199deaf426051a6605391d175a7a9d391e2e9251b0e30bccf2bb1f2dae1150bd7f716c6bb533fadb19e220170a87cfc39fa03ccbadf2a3de3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab36AD.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar371D.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit