c0c62a77130884bec60c2ebae1fe76ffee24745f7f54e8e63955db1f210b177e

Analysis

max time kernel
120s
max time network
130s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
23/08/2024, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bbbbb13fc41ca236345943846039b860_JaffaCakes118.html
Size

53KB
MD5

bbbbb13fc41ca236345943846039b860
SHA1

ff8f155b46343b2365265470ac57122c4255f08b
SHA256

c0c62a77130884bec60c2ebae1fe76ffee24745f7f54e8e63955db1f210b177e
SHA512

a73df99e8608ac16e39d66d787a95f117ba92d11867df708ad12f478502d45e3bf1ac6ce4410119bae57282f9993c1cf18a11eec15a5b1622a1ef5d6fcf690a6
SSDEEP

1536:9kgUiIakTqGivi+PyUUrunlYk63Nj+q5VyvR0w2AzTICbbBol/t9M/dNwIUTDmDi:9kgUiIakTqGivi+PyUUrunlYk63Nj+qB

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 406f9a8158f5da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430578124"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8B93F611-614B-11EF-B75B-4298DBAE743E} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c920000000002000000000010660000000100002000000097bb6c94329092395bb8abd1064718c3fa7eaf04657d38c822a00f8956279d87000000000e800000000200002000000042dc31ccaaa4bc58d2182aa6a405b2cbc4bb57cccc5f70ee2fe97081957323d02000000038ae946c7613169765398207eac9362bb2999c9ce22c445f786ad869ffdb565f40000000f72a9d546a280e0f282918daf7a8756fcf32604ad7226f032aa14bb927189340d4a311389a07722fe32bfae09aa47550d7ca5ae202813d0890926604d1112f66	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000004ecca440099c424d92937bb9b1db2c92000000000200000000001066000000010000200000003154b0a7b08a36fb7e8ba1354f42d9a720e91dd857404482e8e821eadcd4f1a7000000000e80000000020000200000002226e3fc11b05d58106d27fa0a41590f68c70ca6d80dce9afee5b95063fc4d90900000002f3f4af0876831c0d4a02bb20f319a4a733b1b173473ac210d6fb001d91f6dccd11d1360c176e226e107bded3c74d539be36aa1ffcdae5d276e649e3c5cc0f5f9bc280d86a0aeaadd421485cfa3282061a102daf1cdde1be873bcfead870e19009fc379502ae40f4962e3105b516df85b02f95c63983b68727b044e5d8f4e74f40843f2878d2f1deb5d12d7bf433589240000000f045413c7f216157d86472c40b6ce53a85bc7648f486775941e5297f5fad7864ab10643622f2a3a8721549862d836c4e10cffd6c9b3ba2fc614f542bc75053fa	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2257386474-3982792636-3902186748-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2688	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2688	iexplore.exe
2688	iexplore.exe
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE
2696	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 2696	2688	iexplore.exe	30
PID 2688 wrote to memory of 2696	2688	iexplore.exe	30
PID 2688 wrote to memory of 2696	2688	iexplore.exe	30
PID 2688 wrote to memory of 2696	2688	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bbbbb13fc41ca236345943846039b860_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2688 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
956ed88f4b95e4263f8851bd1cc1fc68

SHA1
1f32e9409c5fd10d990a4bea1ddb554ac3df5b95

SHA256
851df9343e65a64afe73b11775ddd32419c13e924ca95d57c0c111f3e3069436

SHA512
1a9ff138b03c51aa500287d0b570e4c42ca892fd9760ad57e66a0025245713bc0f4f1672005beb9350d74fb40d25d0d4b2f3cea9a7b50b401ac28ffe2a5606e9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a395f9859621de68128556d43b8fb790

SHA1
4943bc5413658ca5d9d789ed8f211723532935cd

SHA256
38939bf4c1f590a76accdc2652fb59850ac2c4d6096639780101215ed002a8a4

SHA512
757918d3d56d35c283c3dcfd70ad48d1454e4e8d205304f0679e376b7bb28e007d8249d1fa82769d3957a4d8cb3beaa587f5a9e83af42027df66ef570ef1d29a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0483c59b163b79040baa9fc9fd09a5de

SHA1
88ee1102a0faa5d9a9df60973f9724404c559b29

SHA256
9fc882c318c335601cb5b2844d7e1f7c14e6553090d0d110d2e1c57366083520

SHA512
348f4e473b93a542e0a60abc8bd388e1ea000234d0fe106ab11ad44a6d226bbbb81b1c6de0d8c4c15b68d42c4b8bbb80f695002a6e70dab5049d3f44ef914c1c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0958100529b9f9ab11fd60db0bdeffda

SHA1
5df014379f8669ff12643e6232ed9bb3dad335d4

SHA256
fe286395fa60b203deca97ab7b23273527f4e2187366fb4e62bdb7a0ac05310c

SHA512
2eb3d5feadb023efc27c729ba93263a52635c8d1ad6a73465a0227eb9138c5cd9987fc7282a6c4a48ecf51381bb9c7bfa435168c778ca94e549681d9d103e5bf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6d4914a912da7d2852c03c9ffaeedeff

SHA1
86839a5f7e9f3e7b69d524c60b01e9ab2c10d9d3

SHA256
69bbc3d2b23570599ccc0f6c1fc721139f69687a9221df29853b1bcd19124918

SHA512
589b797b6741d32e5c44fe2978b47a6772c5fcf1a3918b87af1c29484795745fece4850d284a69335aa4254763143dc115f17d0014f59bc46c2217ac46486613

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f09d03775f46e75c7a4e658385801bc0

SHA1
d4fbfe9c9e697d0723d5b70bdf1a01b10efa5c5f

SHA256
c2e6b6cc9b429131139c329a7a814e2e6268ae8b67605289d730ad3e1c9b3728

SHA512
c45d44fd79aa34f5d02df249b88e25eb074d011c39111b33b7f9c8c9794460a4ebd44f325b1323ea0de6b38d39ebf43fb34248b94ea676e23a64b38ff525a871

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b46c842b93601003663d54e4e150b53

SHA1
79d70c23b01e54b5513b5785f0ca7537328dbb5b

SHA256
19e83bd6aee6278fc5f072ead8dfafce8e1ce1ccdec88c90438e74de771a1487

SHA512
1e66833a81e62337392acb3c6515b44f04e2992442d062518a54f1462abcabd7db8b5430c651d82824c762a061d223e17197265c3e2c83924577121532a04f63

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c8429557a80967631a36c2c40a99ae57

SHA1
33fef825ba79c376cb6197e73d00b512aac2d26d

SHA256
e3e1c678486c18d8a84f0a1804abb2b9ebc40f4dc421e38dcdd63619de5c2a3f

SHA512
774c1b3becb0862841cfd62e1163ee39178d297e7cd62cbbdf7cb1958dcc5c4a7293fd589dcdec580dbd0d1b986c17992505e82ad8ad0754f43b2acdec9926c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
83ba8451afac243f81a039464b61fe09

SHA1
738df27b7b6920b9daee16cd65d71d12c616dfb5

SHA256
c9002f3a60bf55de461dfe4641fd508596bc90fe6e178fc5ee9ce589cabedc14

SHA512
d4ea8799306d71e4098564b271fdec806ac5f12b1f994f0fca5be2724ab55037f9de3379e60d7105e63efb5a00ac4dee999fca9dd09f924cf11e0a2267a0a532

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
634c8fb68d2693e885561842da76e701

SHA1
2220ab799fa30f664c937af881f2d07ddf34e8b2

SHA256
8487e3a3edcabebdec57984a768f30defc5fc4107a1de76ac2676192d81ced56

SHA512
a6afc3f0100b05a0b92c209cfc6c95e89f1ccebc3135d44d7fccbf7566a23255e4dc24069936f78f9c89e2792ec7c5d45fe8fb992ddb61bb23ae443431e2e0d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6GL24G53\style[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab52F4.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5383.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit