b5146de7f4cd4e1fbcd0b12c6ee8b380ebf809531bb4828602066d783ac93c77

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
24/08/2024, 09:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be5a97f918f8b8a0409424c63ab90228_JaffaCakes118.html
Size

472B
MD5

be5a97f918f8b8a0409424c63ab90228
SHA1

0e014e607f39b4bbb81bc0cdf1405ad5eee39bff
SHA256

b5146de7f4cd4e1fbcd0b12c6ee8b380ebf809531bb4828602066d783ac93c77
SHA512

be1ab98276fd73490a88cc3ed1ef8c1ccc4b0739358187067cf6c1ad85a0c76726da885b903248d231a7a96dd197f4ef5008aeff29173fcffd0291a4a36e6e4e

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "430655399"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c02a7c4b0cf6da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{770093C1-61FF-11EF-8419-5E235017FF15} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb7800000000020000000000106600000001000020000000823531eb359fa6e3e2e4bb2355790a984f3cfaee4f8dbcc9d9561e2f672bc73d000000000e8000000002000020000000f7e4b32028cd4d8476fb0c8b905ff1f2c76a9fcbeb0259977467fe967e578f1f90000000687d3758946b473b8286e4612c3f628d31fa888091e907169dd330ac43b591922879185fe8af3964138af81d0301d8e18ff7da696c7c457683f02db8bc726cd99aa4b24fd075feba9cc7d850f4778c32e57647b7540f178b6625c27ef5c7bce10178f2d07949204e3d1a43b81318c738893dbf8337332633435946937b4da1f446ee0b5ebcd53786cffee8d11e0ea1e04000000041e376dc4ffe727bf337d6477cd62cc5ff7c41574b4a99ca9d2d735611d0807ea208911f5e3614109e0bbd14fd1166f0426f5858ad63f0fedeef475d41330a2b	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000062974e5b5f804e45b98349be16bffb780000000002000000000010660000000100002000000076e2e39c84045b66a84b517ed6f1af67c469689cc076fb5b35125d5ada436d45000000000e8000000002000020000000ab8d23c2d0736ae99e363fd1a56edb1a57dfba6ba830e7d9c2413cb3804a2f33200000008c08dafa4248857b63742aa251d84dd15707ad59e01a346332415e6f5bc0452740000000a9d79e11b501a199584dde2b883f28e5e1673497c98ef264024ad00f1cf68c9d598994eb26cf3b7362666576dc78b74280a05ef0e31be08ba87e24bd2fe53f18	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2104	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2104	iexplore.exe
2104	iexplore.exe
1544	IEXPLORE.EXE
1544	IEXPLORE.EXE
1544	IEXPLORE.EXE
1544	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 1544	2104	iexplore.exe	30
PID 2104 wrote to memory of 1544	2104	iexplore.exe	30
PID 2104 wrote to memory of 1544	2104	iexplore.exe	30
PID 2104 wrote to memory of 1544	2104	iexplore.exe	30

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\be5a97f918f8b8a0409424c63ab90228_JaffaCakes118.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2104 CREDAT:275457 /prefetch:2
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
c7ff779a9f1151dab0bb33f3cf810432

SHA1
1f370c677c2388e3fb2f774964ff963e61d4dd77

SHA256
3ea471470a648a3b4d1bc5aacd95564ed86249994f0ca558b7cbf5d882e6179a

SHA512
803eb1267bb8f9362f815a2158d3ed2c2990cddfc1306aac5a5ab9e94e40fddfeea29828fef1b9d270993f2d005ab25085750037df7f00f79bcc4674e24931f8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1fe807619d0ac267ec581fdcb38af375

SHA1
a7d46762fb0c7d6618ae749bf824da18c3478ac8

SHA256
b4325313bb6fafc370007c6540c1e203fa88fe50dc7b1b84c95aeb1657a900d0

SHA512
62e8be407c75b3e8c2e1de8e88577d43b98e3339e7a8d3ece11b7ddf12c7416624f4a1d59891ad7b6046e38faac55fbfaf2d4241e945584c7cbcf3eeb7eb1e72

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2cc4ffc4f8dd73e1d0bff097d2c768df

SHA1
e6314f097589164d74c219059fcf385c62c998aa

SHA256
607f7997502e3a5ec0b623a705a12e40ef0048f4eb7b408009b60351bf00fc4c

SHA512
70dd6a871a7233c19bf5ec326304f985341ce0c59a0764fa755ae6dbeff67d59f00256823b974a8492cbf163d2bd1556ec4ecc1e88cff5c06b8f2f139d8c945e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
1117b9010fff53d11646a88a6c25ed1b

SHA1
1354a95f1dff7b9c36817e8bcd52170f7d22abdc

SHA256
a20a060c53a8f5287ca9ca60355e23827dd326149499921bf6863653cbb2e677

SHA512
a64b9a6d82f44eef01c12a4a27ff0fde9d6a77c976d597aefe18f7a4a851a631007ee3dd41eeede013fcb4178172cec4eef525dffafb128e903174e8475fc5fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
dd0a99281d39c2f3d18fde3f4201059b

SHA1
6bb818da13cbcd939198c67ae7015be713adf204

SHA256
6b8d4742342e289e63c3d0ab5a83e5ab826243674e513839944c5c54983e5b44

SHA512
59c96f4ad00234b2e9c2229d987f7be8ec6c4f90cd1d752648d2f7f24981e51280b46d8519c99b557b00343541938775f5787f04b831b159df16f99f495c38f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a2a30a9cc981dc267a49132694131f5

SHA1
dd77a0b3faaee5283c9cb787e60897e566b970d3

SHA256
40510e9cde35901ed64f7f9df826e625f8724910241c5888b6ca9a67c6c553a0

SHA512
ebd822f7a27348d3a20371438cad7e8f74f40836ca15c93b109dfdcba953c949a8b3d1b9e9a7b804aa382017f3b9a6615929837713edb9656bcc7994360c7765

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7d24463bd7fb4e52cabb6cef39ac1f25

SHA1
0fd50680f9030b4270bc068b2dfccc7a3f136788

SHA256
f8b88704214e96d08d1a3e338b3a4fdbd0deec3c9f1f0f6c44637f5d3957b8eb

SHA512
0c7c03d272aca3194a77d92de71228f0ec461a5e8ff2eb1e3bdfeac50845c041f1b1df7980e26c176feabae1c28bad87f68e33ec1d86fab11dc3a694d771e3d3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb5452b027d4407150f2aaeed10d9749

SHA1
a8ff160200eb7bd2c28ce77b642d6a820f0e59da

SHA256
e690cce62bfc8fd0ef196b840eccb4acae17131c292f03d59d33f4b862a9d6a5

SHA512
50193cae6947549bea67d20cd2ee72158505aa095aa811cbab9dcbb8ade2d7fb6420df72831776d5b2e1bacb99be671ed79a9ba7a3c5f467a70d6b1569d9061e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
8487be6f7e4cf05f1d215b3e71cfa3a9

SHA1
39ba9a7ee37c06bdd720e88427de57095c5b4b00

SHA256
a6d75c4d29d9e0e6c593e713b601591a1c9073ff85ce29be25a98119a02001a8

SHA512
925d45c4c6e2c47899aea0119eda63ee802c26d7ee34b78d4168c3351b4d8b6bcec1f49d0e5fb8a01b26660d8a01f6891085cff8a8e6a96aa7c197bfef1a4e5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b34907896114b8aa82337a16fdda12b8

SHA1
3a80315666c0e1142e7cb12e46e927023f69fbc4

SHA256
54fa8b982c2169ebe74a1fb886e161b9de7b87f00cb30ec188c314bfa664af12

SHA512
f820e9d9d26800caaa84d6acacb8640df4160caaf1a2e6fc2f562172daac7b6959568e84ce9283acae96baa8533d9dbd9f59611bcff400bedbb3dea91d951ab9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15552be41f230d3473bf8f2e549774a0

SHA1
25fd915a46b16ebd0c8cb6235ff2116038e92160

SHA256
f3644d93f07badd1d505d604f888da0f209a83b77a3b4b68e7d4289649f7b635

SHA512
0c54275f6481dc39563638836b6ba92d15bdd29943a2d85deb2ed15611192f28eccd54c89ef71eca7c8425357713c61bf56a11d3b173ecc287a5147de705f700

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7c877a036e6714c4d1eed8e23be60d41

SHA1
f1d9aa306c73732a36a169360272e3b56c926580

SHA256
c0bbcaf7d3984170476b2605eea48886347e212da7ce9c01c3f668189238e305

SHA512
a7815ca06bd6e6186a4d3a1197bbfa3dc73704691ae2a5e7251f2e11a00e2e398493dd24a7d99ff702ca886a3bd931dd5505474bfdf8cbeb0b2198580b8174a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabCC95.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarCCF6.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit