5e79765b019de70387661eae0449533ee6aee12977cf7d887b517b4dee45bdb9

Analysis

max time kernel
119s
max time network
128s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 21:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf76d6183bb66022a9d471188399e9e0_JaffaCakes118.html
Size

832B
MD5

bf76d6183bb66022a9d471188399e9e0
SHA1

5e4971491103f1adca4f49997a7ec63c5210b0cf
SHA256

5e79765b019de70387661eae0449533ee6aee12977cf7d887b517b4dee45bdb9
SHA512

d02d2dcaf029c3f9d434a63c14a10ada3c98fe9494bdfa0de4591420344645f005e117f10389737830759e134c3c09ece15278c9779812d2b767c4cfb58dffd7

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 003bace16df6da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430697338"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1CA19521-6261-11EF-8EE0-F67F0CB12BFA} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000658f6a810363a70e6f5e4ab8d4ea6f976754ac0a5ee8aced5dcd202e4ffbc2d5000000000e8000000002000020000000377475a790caeebfa1d59a659b7131f2a49b89744077e8a47399c4ed75014738200000003219aef683b3764eac004cae8680d13a96d5d87cad71f2c3ae8214f122da8c034000000053c5c08ef3c90d8513396a4e40429b383acd9617bfcf62ab2ae2f07dab02be2e65454dc7c77280550e04702063c78d7399e1516bd6c2b6822e4ef214e55216f0	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000d854e951ecdca4792ad3aea80f0355100000000020000000000106600000001000020000000f27f8af876d28cab5675a05adb6102c2d2ffae05b39a9a961649f3397b0ff0c4000000000e800000000200002000000077e0857c2aaa2090ae86334e1247c3b039c58df1f909dbc7f981fcbee0cae300900000004f66b14f070b6e1716e214a331f46877a9a143c16a78000ad162613f109dbb4ac01cd88a3e3a3faf1394af8f729aa286b2db0cb374588ec33a2c7d2e359ad58436553a72595c50aed9d038a6ede85a4946fb623632d7a5aa90c8e68692fc51cf523f2f865e2ef64536f629cdcd9d63b408e8fc2406bea702b1b5ccb348dfd054bb1b4fbee35f754071c3307dce1a3cc240000000c1b84217c3da175b1db65886d7410f23529fbd8fed00f4b138c1020b7db1bcd3c280295cf428076aded9d982fc6abb9f67a9fa681493aae1f935e24d2fdb20f9	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1720	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1720	iexplore.exe
1720	iexplore.exe
1100	IEXPLORE.EXE
1100	IEXPLORE.EXE
1100	IEXPLORE.EXE
1100	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1100	1720	iexplore.exe	30
PID 1720 wrote to memory of 1100	1720	iexplore.exe	30
PID 1720 wrote to memory of 1100	1720	iexplore.exe	30
PID 1720 wrote to memory of 1100	1720	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\bf76d6183bb66022a9d471188399e9e0_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1720 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
430913982646dbbbaf1ff517313a84c6

SHA1
e9e2cc8fa062b9ede1dbbe82db8f0f62ef5dfc43

SHA256
065d51d34467909308175f0f23c32cff58d2bb311a0cbf9d210b2d119ff05aa1

SHA512
b36d9cd3678ffbfb1d7a60e08dee7ef52a9feaab026c56ad7dbd6b5726ca782cc98f21153859c74df3659f3f051cda4db3edf1adbd101d2dca7f09b65e9e60a8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9b2c297e19796b8c26e19b87657fc351

SHA1
76e82f93379439add54e6937d4688afe69c0a355

SHA256
6d430c5166ed8db8b31832d16705a79f35a4ca8f2e0b9665d98a39db4784a2d5

SHA512
4d5a09d39dabef1c314ba05d9d844c2baf19585f9f63e5fd033c89df53b4bdf9720d6d9ea653f8e8fcfff9feb52999bcf99163ce5412709fb3d7c9dfdfae8232

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3f76a0d5f84575d9a88543028473edb9

SHA1
da8eaa92c41295006f2ec42a0331dce0d29243c4

SHA256
8bcaef496baf4078fd8ce2b0849c1a5ff34babe44c76419432fb943bbaea1ff5

SHA512
d50f44297ea9626b8fabe2eb3e9933b9e429fc87865d65515df4099f011cef18b5496c668c13eef850a29c3ad7c5037e31ffc9fff536461755977a3632d8da67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2221b7c9cdece4c1045df119c1a6c243

SHA1
70fabf99c7eb542c1a4c6f8f225c1e3a2abb6491

SHA256
99a37f7c7cb24c6aebdb29ce255ec625727a75e315a0e7806f77012b8734db59

SHA512
d268be5a5449e6e9cd8c8b4843a27b1bfaf2144e6624f4fbbb0d208f6471a991b841ba32f838c310d269042ff470d3b9492c51d0ad27cc7dc0860a5f8cb69250

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4402f5f4bdab5ba3ec7927c2e767ba8f

SHA1
3aec7498c1df8fea91bc558f08606c8602111f7f

SHA256
eaf928b5e01830d83057ed1f6bd605a76e5fa879ea24935b84904f1be3a3802a

SHA512
960ebee4c56490885cd091ba28b8366d5b2b106d13f08ea312d1b777a669940e6d8aa049db5c5bb1c73c797e7d48ca4db45048231cbf5d636df4150eb39d9ee1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c9a08b12f06c26f62a97dab30187503e

SHA1
d4271d203db8038af882701299455c69871e029b

SHA256
53aefa0c294dd7837fcbc3ed37d2de23ef5b7fdc711022a95d3f4fae94f77845

SHA512
549b1145f7975c7f1e9c96b5eaa47dd66fe6036c1a957ea328a96e60f24d8390505f6c9b8a0db380cada5767139a01824b10b77e560d1dfa24e0831ddd924cf7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
00d2f43128ef4305ee10ea7dad1412c7

SHA1
90057ca9f07b99d0b0c417027ddaf13369ea04a6

SHA256
df405a7f9e9bca6d2454ed919f7c5bcca828c979b024462b7908ca33dfe09dee

SHA512
431d6fe7c626f38defa708d08d2d38fd9e518bca2cbfb67e9acb1890bb81aee998f293b0edc937617583683736cc0e45802b11cc7800f2521a2ad8efdd28b111

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8bc46f6fef25559395e6a017f340c82c

SHA1
7653df471da403b3e7176019d300bd433be9a424

SHA256
5ce38a12a72c3ef103ab26ece95348d5cad445c53e40d6b180e9a85badbe356b

SHA512
0df15478fd0d64e44fb8b8957f8dc95f0e715fdfa1b911edbd8573eb18996746da4bb0bb61839716204012fd199a7073277c46200c7095a74c2812e1dd4da697

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc89e5ac65b82dcaaa7ef4e73b0b5a39

SHA1
debdd7274089f8b5efba11c562caa04665d99812

SHA256
8f359b41d03386efa9683972d71d00398a7bbe617e4935bcfb9fc521d0197d29

SHA512
46aec7c93c9643e3412603fefdfa0d6f04a6e1734abe9544dbd626931aaaecd2c1c2cb66dbb7165c8eb25fb74200bca998be926b45e7e5398d2eaff80ed79e1f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e62860d1e11308a307e6c2f67458b582

SHA1
3df614396255e1286a1b02f8a59b7dfc0e240cde

SHA256
3fd4021a63816747e9cf4685799b7fcf5d76f2387cc88756b77e3f3c54513113

SHA512
2a81992231911c47ce646d47782b39800779c7dca5fc6088b18218e1c247f9c55c42df436300c0b31f586946ae6067ff1212584da5614126290d98ab369f8ae7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b178b9bb9c57338128bc7082a5756c3

SHA1
efcd3a670f0d34ea0f60a7e4aef9028b3b18c88b

SHA256
7c75f82f69dd4ed93e02fa840852af1eced3d1c94cceee484a1ce4d3c860a309

SHA512
7168215b26c96d0e5a5cb892ad8fd714a4fc57c9714af24c8c52e1e9a4e404ea5a275d997450b67e953a21d5d037a960305ec27983657efd90c4a8226b68dafa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ae8b69bdde2b8945bef46c58ed78f2a3

SHA1
a08d333d122d8de5a16c17662076c66682dc5d0d

SHA256
c59fcd9b00896ab7be221eeba7a12e937c99973baae6f5615e7d9e0268bf0795

SHA512
624f6223381d3db0f484a66c8529de2efc847458860d78c9d6c25e86adea94150c6953ee34ebab1b2d1239e54191159cf6481deafc54a26834b7347896de2109

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7cffe8a3c150260b92310ff9c06289d6

SHA1
2db54ad815d45a36a68ef78ac78cbdfd9574d084

SHA256
7a8a374e462bdd7f2437ea7dbc6e44bd0e34d83f8306f51b6c88d58ddb7d0ee9

SHA512
01aee1d147f9b9f385db43c531d5bc155d20609886a00b35857e4061d214154971c783da659be8171d842b8213d98cb8e14948e066cdfb26c3eb1be679be5879

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3bd8a3f11ddd3afe24021e8dc0cbc40

SHA1
75c7e3321eb70581f5bd29ffd2c104921f211453

SHA256
5db5a5caedbe51171399002ce5eda13ff97f3df9997b97d6b9d138ce1758c97e

SHA512
e28a550c4288b184b3ae868dd00f9be743720087a219174afa8ec6cbbec2b066957b1cdd2ec1315ff297372af9fdb7060a287a24298271eb33094f481044afb9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4302e7dae91c81cb8804f8188976b4d4

SHA1
5c79aaee1925d01940b964b0672f5b0b66ea61c8

SHA256
30884ae591491775f56365750e7ea1423f8218e513d4b0613e70eeb6f377f46a

SHA512
e1ce8f0078a374d119ee243278071ed27e7110e4d61b0a9cd746c713c73329df07b8af9396be729f4b291a9cc79b3766b0eb91cdbd7071f4a6f8d2151747c9d2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
60f9e847806934c444ab2e61a37230cf

SHA1
cb000eac63fb57547e700c66b3c0f1ba2ff66ff7

SHA256
d919a3cf9ae86ce759aeaf72040e05efe846d0d5dcd64b504f20afda80c0ed0e

SHA512
1bf74eb328c4ac861fed0e4d55c3aff12f443bd070f47a4b670bdeeb859ab96694853958087bc032ce8eccb2331de7022e3fe791387b3d96bccf80913b39b5fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabD73D.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarD935.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit